Practice Test Geeks(CCE) Certified Computer Examiner Practice Test
← All CCE Flashcard Decks

Mobile Device Forensics Flashcards

7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Mobile Device Forensics flashcards as text

  1. What does ADB stand for, and what is its primary use in Android forensics?

    Answer: Android Debug Bridge — for communication between a computer and an Android device

    Android Debug Bridge (ADB) is a command-line tool that allows forensic examiners to communicate with, issue shell commands to, and extract data from Android devices.

  2. Which Android directory typically stores private data for user-installed applications, including databases and preferences?

    Answer: /data/data

    The /data/data directory on Android stores each application's private data, including SQLite databases, shared preferences, and cache files, making it a primary forensic target.

  3. When is a chip-off acquisition typically used in mobile forensics compared to other methods?

    Answer: When logical and JTAG methods have failed or are unavailable

    Chip-off is typically used as a last resort when software-based and JTAG methods fail, as it is destructive and requires specialized equipment to desolder and read the memory chip.

  4. What types of forensically relevant data can typically be found on a mobile device's SIM card?

    Answer: Contact lists, SMS messages, and last dialed numbers

    SIM cards store limited but forensically valuable data including contacts saved to the SIM, SMS messages, and recent call records (LOCI data), which can corroborate device-level evidence.

  5. Which mobile data acquisition method uses the device's own operating system APIs to access and export user data?

    Answer: Logical extraction

    Logical extraction leverages the device's built-in operating system APIs and backup interfaces to access and export data, retrieving only what the OS exposes as accessible.

  6. What is the primary forensic purpose of storing a mobile device in a Faraday bag during transport and storage?

    Answer: To isolate the device from all electromagnetic signals including cellular, WiFi, and Bluetooth

    A Faraday bag blocks all electromagnetic signals, preventing remote access, location tracking, remote wipe commands, or unauthorized data synchronization while the device is in evidence custody.

  7. What database format is most commonly used by Android applications to store structured local data?

    Answer: SQLite

    Android applications predominantly use SQLite databases to store structured data, stored as .db files in the application's /data/data directory and accessible via standard SQL queries.