CCE Mobile Device Forensics 2 — Questions and Answers
Question 1: What does ADB stand for, and what is its primary use in Android forensics?
- Advanced Device Bridge — for device backup creation
- Android Debug Bridge — for communication between a computer and an Android device (Correct answer)
- Application Data Base — for structured database extraction
- Android Data Backup — for creating encrypted device backups
Correct answer: Android Debug Bridge — for communication between a computer and an Android device
Android Debug Bridge (ADB) is a command-line tool that allows forensic examiners to communicate with, issue shell commands to, and extract data from Android devices.
Question 2: Which Android directory typically stores private data for user-installed applications, including databases and preferences?
- /system/app
- /data/data (Correct answer)
- /sdcard/Android
- /proc/data
Correct answer: /data/data
The /data/data directory on Android stores each application's private data, including SQLite databases, shared preferences, and cache files, making it a primary forensic target.
Question 3: When is a chip-off acquisition typically used in mobile forensics compared to other methods?
- As the preferred first method for all Android devices
- When logical and JTAG methods have failed or are unavailable (Correct answer)
- Only for SIM card data extraction
- Exclusively for cloud-based evidence acquisition
Correct answer: When logical and JTAG methods have failed or are unavailable
Chip-off is typically used as a last resort when software-based and JTAG methods fail, as it is destructive and requires specialized equipment to desolder and read the memory chip.
Question 4: What types of forensically relevant data can typically be found on a mobile device's SIM card?
- Application data, photos, and browsing history
- Contact lists, SMS messages, and last dialed numbers (Correct answer)
- Encrypted email content and full call recordings
- Device encryption keys and biometric templates
Correct answer: Contact lists, SMS messages, and last dialed numbers
SIM cards store limited but forensically valuable data including contacts saved to the SIM, SMS messages, and recent call records (LOCI data), which can corroborate device-level evidence.
Question 5: Which mobile data acquisition method uses the device's own operating system APIs to access and export user data?
- Physical extraction
- JTAG extraction
- Logical extraction (Correct answer)
- Chip-off extraction
Correct answer: Logical extraction
Logical extraction leverages the device's built-in operating system APIs and backup interfaces to access and export data, retrieving only what the OS exposes as accessible.
Question 6: What is the primary forensic purpose of storing a mobile device in a Faraday bag during transport and storage?
- To protect the device from physical shock and impact
- To isolate the device from all electromagnetic signals including cellular, WiFi, and Bluetooth (Correct answer)
- To maintain proper chain of custody documentation
- To prevent battery drain during long-term storage
Correct answer: To isolate the device from all electromagnetic signals including cellular, WiFi, and Bluetooth
A Faraday bag blocks all electromagnetic signals, preventing remote access, location tracking, remote wipe commands, or unauthorized data synchronization while the device is in evidence custody.
Question 7: What database format is most commonly used by Android applications to store structured local data?
- MySQL
- PostgreSQL
- SQLite (Correct answer)
- MongoDB
Correct answer: SQLite
Android applications predominantly use SQLite databases to store structured data, stored as .db files in the application's /data/data directory and accessible via standard SQL queries.
CCE Mobile Device Forensics 2
What does ADB stand for, and what is its primary use in Android forensics?