ACI Mobile Device Forensics

Question 1

What is the first step when handling a mobile device at a crime scene to preserve evidence integrity?

Accepted Answer

Place the device in a Faraday bag to prevent wireless network connectivity

Answer

Placing the device in a Faraday bag blocks all wireless signals (cellular, Wi-Fi, Bluetooth) and prevents remote wipe commands or data modification before acquisition.

Question 2

Which type of mobile device acquisition extracts raw binary data directly from the device's flash memory, including deleted files and unallocated space?

Accepted Answer

Physical acquisition

Answer

Physical acquisition performs a bit-for-bit image of the device's entire storage, capturing deleted data, unallocated space, and slack space for the most complete evidence.

Question 3

What does JTAG stand for in the context of mobile device forensics?

Accepted Answer

Joint Test Action Group

Answer

JTAG (Joint Test Action Group) is an industry standard originally designed for circuit board testing, used in forensics to access device memory through hardware test access ports.

Question 4

Which file system is primarily used by Apple iOS devices since iOS 10.3 for storing user data?

Accepted Answer

APFS

Answer

Apple File System (APFS) replaced HFS+ as the primary iOS file system starting with iOS 10.3, offering improved encryption, cloning, and space sharing capabilities.

Question 5

What is the primary forensic purpose of using a Faraday bag during mobile device evidence collection?

Accepted Answer

To isolate the device from all wireless signals

Answer

A Faraday bag provides electromagnetic shielding that blocks all wireless signals including cellular, Wi-Fi, Bluetooth, and GPS, preventing remote wipe commands from reaching the device.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI Mobile Device Forensics