CCE Mobile Device Forensics

Question 1

What is the primary first step a forensic examiner should take when acquiring a mobile device as evidence?

Accepted Answer

Document and photograph the device in its current state

Answer

Documenting and photographing the device in its current state establishes the chain of custody and preserves the initial evidence condition before any acquisition steps.

Question 2

Which mobile device extraction method provides the most comprehensive forensic data, including deleted files and unallocated space?

Accepted Answer

Physical extraction

Answer

Physical extraction creates a bit-by-bit copy of the entire device storage, including deleted data and unallocated space, making it the most comprehensive method.

Question 3

What does JTAG stand for in the context of mobile device forensics?

Accepted Answer

Joint Test Action Group

Answer

JTAG stands for Joint Test Action Group, an industry standard hardware interface originally for circuit testing that forensic examiners use to access device memory directly through test ports.

Question 4

Which file system format is predominantly used by Apple iOS devices since iOS 10.3?

Accepted Answer

APFS (Apple File System)

Answer

Apple File System (APFS) replaced HFS+ starting with iOS 10.3 and is optimized for flash storage, making it the primary file system examiners encounter on modern iOS devices.

Question 5

What is the primary forensic reason for placing a mobile device in Airplane Mode during evidence acquisition?

Accepted Answer

To prevent remote wiping or unauthorized data modification

Answer

Airplane Mode disables all wireless communications, preventing remote wipe commands or data synchronization that could alter or destroy evidence on the device.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Mobile Device Forensics