CCE Mobile Device Forensics

Question 1

What is the primary first step a forensic examiner should take when acquiring a mobile device as evidence?

Accepted Answer

Document and photograph the device in its current state

Answer

Connect it immediately to a forensic workstation

Answer

Power off the device to preserve battery life

Answer

Install forensic software on the device

Question 2

Which mobile device extraction method provides the most comprehensive forensic data, including deleted files and unallocated space?

Accepted Answer

Physical extraction

Answer

Logical extraction

Answer

File system extraction

Answer

Manual extraction

Question 3

What does JTAG stand for in the context of mobile device forensics?

Accepted Answer

Joint Test Action Group

Answer

Joint Technical Advisory Group

Answer

Java Technology Application Gateway

Answer

Joint Terminal Access Gateway

Question 4

Which file system format is predominantly used by Apple iOS devices since iOS 10.3?

Accepted Answer

APFS (Apple File System)

Answer

FAT32

Answer

HFS+

Answer

ext4

Question 5

What is the primary forensic reason for placing a mobile device in Airplane Mode during evidence acquisition?

Accepted Answer

To prevent remote wiping or unauthorized data modification

Answer

To save battery life during long acquisitions

Answer

To increase USB data transfer speeds

Answer

To enable USB debugging mode automatically

Question 6

In mobile forensics, what is the term for physically removing and reading the memory chip directly from the circuit board?

Accepted Answer

Chip-off extraction

Answer

JTAG extraction

Answer

Logical extraction

Answer

Bootloader extraction

Question 7

What is the default encryption state of Apple iOS devices running iOS 8 and later?

Accepted Answer

Encrypted by default using the user's passcode

Answer

Unencrypted by default

Answer

Encrypted only if the user enables it in Settings

Answer

Encrypted using only the device's hardware IMEI key