ACI Mobile Device Forensics 2

Question 1

What is a logical acquisition of a mobile device?

Accepted Answer

Copying accessible files and folders using the device's operating system APIs

Answer

Logical acquisition copies accessible files using the device's own file system APIs, making it the least invasive method but unable to recover deleted data or access unallocated space.

Question 2

Which database format is used by both iOS and Android applications to store structured data such as messages, contacts, and call logs locally on the device?

Accepted Answer

SQLite

Answer

SQLite is the standard lightweight, serverless database format used by both iOS and Android for local app data storage, making it a critical artifact type in mobile forensics.

Question 3

What is the IMEI number's primary value in a mobile device forensic investigation?

Accepted Answer

To uniquely identify a specific mobile device's hardware globally

Answer

The International Mobile Equipment Identity (IMEI) is a unique 15-digit hardware identifier assigned to each mobile device, enabling investigators to link a specific physical device to network activity records.

Question 4

Which SQLite database on an iPhone stores both SMS and iMessage communications?

Accepted Answer

sms.db

Answer

The sms.db SQLite database located at /var/mobile/Library/SMS/ on iOS devices stores all SMS text messages and iMessages, including sender/receiver data and timestamps.

Question 5

What is 'chip-off' forensics in the context of mobile device examination?

Accepted Answer

Physically removing the flash memory chip from the circuit board and reading it directly

Answer

Chip-off forensics involves physically desoldering the flash memory chip from the device's circuit board and reading it with specialized equipment, bypassing all OS-level security but risking physical damage.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI Mobile Device Forensics 2