ACI Mobile Device Forensics 3

Question 1

What is the forensic significance of a 'deleted' flag in a SQLite database found on a mobile device?

Accepted Answer

The record is marked for deletion but the data may still be fully recoverable

Answer

The record has been permanently and securely overwritten

Answer

The record has been encrypted by the operating system for security

Answer

The record has been moved to a separate backup table automatically

Question 2

Which type of records can investigators subpoena from cellular carriers to establish a mobile device's historical location and communication activity?

Accepted Answer

Call Detail Records (CDRs) from cellular carriers

Answer

Wi-Fi router logs from ISPs

Answer

Bluetooth pairing logs from device manufacturers

Answer

NFC transaction logs from payment processors

Question 3

What types of investigative data can EXIF metadata embedded in mobile device photographs provide?

Accepted Answer

GPS coordinates, device model, manufacturer, and timestamp

Answer

Only the file creation date and image file size

Answer

The photographer's name and registered contact information

Answer

Only image resolution, color depth, and compression level

Question 4

Which mode on Qualcomm-based Android devices can be exploited to bypass device security and perform direct memory extraction?

Accepted Answer

EDL (Emergency Download) mode

Answer

Safe Mode with networking disabled

Answer

ADB backup method through USB

Answer

Factory reset protection bypass

Question 5

Which file on an Android device contains a comprehensive registry of all installed applications including system and user-installed apps?

Accepted Answer

/data/system/packages.xml

Answer

/etc/hosts file

Answer

/proc/meminfo

Answer

/system/build.prop

Question 6

In a corporate forensic investigation, what forensic value can Mobile Device Management (MDM) system records provide?

Accepted Answer

They contain device activity logs, app install records, and policy compliance history

Answer

They automatically wipe devices before investigators can access them

Answer

They block all forensic acquisition tools from accessing device data

Answer

They automatically encrypt all device data when an investigation begins

Question 7

When a mobile device is found powered off at a crime scene, what is the recommended forensic approach?

Accepted Answer

Keep the device powered off, document its state, and transport it in a Faraday bag

Answer

Power on the device immediately to capture volatile memory before it dissipates

Answer

Connect it to a charger to ensure power before any other action is taken

Answer

Remove the battery to prevent any potential data corruption during transport