CCE Mobile Device Forensics 2

Question 1

What does ADB stand for, and what is its primary use in Android forensics?

Accepted Answer

Android Debug Bridge — for communication between a computer and an Android device

Answer

Android Debug Bridge (ADB) is a command-line tool that allows forensic examiners to communicate with, issue shell commands to, and extract data from Android devices.

Question 2

Which Android directory typically stores private data for user-installed applications, including databases and preferences?

Accepted Answer

/data/data

Answer

The /data/data directory on Android stores each application's private data, including SQLite databases, shared preferences, and cache files, making it a primary forensic target.

Question 3

When is a chip-off acquisition typically used in mobile forensics compared to other methods?

Accepted Answer

When logical and JTAG methods have failed or are unavailable

Answer

Chip-off is typically used as a last resort when software-based and JTAG methods fail, as it is destructive and requires specialized equipment to desolder and read the memory chip.

Question 4

What types of forensically relevant data can typically be found on a mobile device's SIM card?

Accepted Answer

Contact lists, SMS messages, and last dialed numbers

Answer

SIM cards store limited but forensically valuable data including contacts saved to the SIM, SMS messages, and recent call records (LOCI data), which can corroborate device-level evidence.

Question 5

Which mobile data acquisition method uses the device's own operating system APIs to access and export user data?

Accepted Answer

Logical extraction

Answer

Logical extraction leverages the device's built-in operating system APIs and backup interfaces to access and export data, retrieving only what the OS exposes as accessible.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Mobile Device Forensics 2