ACI Mobile Device Forensics

Question 1

What is the first step when handling a mobile device at a crime scene to preserve evidence integrity?

Accepted Answer

Place the device in a Faraday bag to prevent wireless network connectivity

Answer

Power off the device immediately to stop any running processes

Answer

Take a photograph of the device as found before touching it

Answer

Remove the SIM card for separate analysis

Question 2

Which type of mobile device acquisition extracts raw binary data directly from the device's flash memory, including deleted files and unallocated space?

Accepted Answer

Physical acquisition

Answer

Logical acquisition

Answer

File system acquisition

Answer

Manual acquisition

Question 3

What does JTAG stand for in the context of mobile device forensics?

Accepted Answer

Joint Test Action Group

Answer

Joint Technical Advisory Group

Answer

Junction Transfer Analysis Gateway

Answer

Joint Technology Assessment Grid

Question 4

Which file system is primarily used by Apple iOS devices since iOS 10.3 for storing user data?

Accepted Answer

APFS

Answer

NTFS

Answer

FAT32

Answer

ext4

Question 5

What is the primary forensic purpose of using a Faraday bag during mobile device evidence collection?

Accepted Answer

To isolate the device from all wireless signals

Answer

To prevent static electricity damage to the device

Answer

To maintain a documented chain of custody

Answer

To prevent physical damage during transport

Question 6

Which acquisition method for Android devices uses a developer tool built into the Android SDK and requires USB debugging to be enabled?

Accepted Answer

ADB (Android Debug Bridge) acquisition

Answer

JTAG extraction

Answer

Chip-off extraction

Answer

iCloud backup extraction

Question 7

Which AccessData tool is specifically designed for mobile device data parsing and analysis, including iOS iTunes backups?

Accepted Answer

FTK Mobile Phone Examiner Plus (MPE+)

Answer

FTK Registry Viewer

Answer

FTK PRTK (Password Recovery Toolkit)

Answer

FTK Imager