CCE Mobile Device Forensics 1 — Questions and Answers
Question 1: What is the primary first step a forensic examiner should take when acquiring a mobile device as evidence?
- Connect it immediately to a forensic workstation
- Document and photograph the device in its current state (Correct answer)
- Power off the device to preserve battery life
- Install forensic software on the device
Correct answer: Document and photograph the device in its current state
Documenting and photographing the device in its current state establishes the chain of custody and preserves the initial evidence condition before any acquisition steps.
Question 2: Which mobile device extraction method provides the most comprehensive forensic data, including deleted files and unallocated space?
- Logical extraction
- File system extraction
- Physical extraction (Correct answer)
- Manual extraction
Correct answer: Physical extraction
Physical extraction creates a bit-by-bit copy of the entire device storage, including deleted data and unallocated space, making it the most comprehensive method.
Question 3: What does JTAG stand for in the context of mobile device forensics?
- Joint Technical Advisory Group
- Java Technology Application Gateway
- Joint Test Action Group (Correct answer)
- Joint Terminal Access Gateway
Correct answer: Joint Test Action Group
JTAG stands for Joint Test Action Group, an industry standard hardware interface originally for circuit testing that forensic examiners use to access device memory directly through test ports.
Question 4: Which file system format is predominantly used by Apple iOS devices since iOS 10.3?
- FAT32
- HFS+
- APFS (Apple File System) (Correct answer)
- ext4
Correct answer: APFS (Apple File System)
Apple File System (APFS) replaced HFS+ starting with iOS 10.3 and is optimized for flash storage, making it the primary file system examiners encounter on modern iOS devices.
Question 5: What is the primary forensic reason for placing a mobile device in Airplane Mode during evidence acquisition?
- To save battery life during long acquisitions
- To prevent remote wiping or unauthorized data modification (Correct answer)
- To increase USB data transfer speeds
- To enable USB debugging mode automatically
Correct answer: To prevent remote wiping or unauthorized data modification
Airplane Mode disables all wireless communications, preventing remote wipe commands or data synchronization that could alter or destroy evidence on the device.
Question 6: In mobile forensics, what is the term for physically removing and reading the memory chip directly from the circuit board?
- JTAG extraction
- Logical extraction
- Chip-off extraction (Correct answer)
- Bootloader extraction
Correct answer: Chip-off extraction
Chip-off extraction involves physically desoldering the memory chip from the device's PCB and reading it with specialized equipment, providing raw access to all stored data.
Question 7: What is the default encryption state of Apple iOS devices running iOS 8 and later?
- Unencrypted by default
- Encrypted by default using the user's passcode (Correct answer)
- Encrypted only if the user enables it in Settings
- Encrypted using only the device's hardware IMEI key
Correct answer: Encrypted by default using the user's passcode
Since iOS 8, Apple devices are encrypted by default using the user's passcode as part of the encryption key derivation, making data cryptographically inaccessible without the correct passcode.
CCE Mobile Device Forensics 1
What is the primary first step a forensic examiner should take when acquiring a mobile device as evidence?