CDFI CDFI Mobile Device & Cloud Forensics 2 — Questions and Answers
Question 1: In cloud forensics, what does 'data sovereignty' mean and why is it forensically significant?
- The right of users to delete their own data
- The legal jurisdiction governing data based on where it is physically stored (Correct answer)
- The cloud provider's ownership of stored data
- The encryption standard applied to cloud backups
Correct answer: The legal jurisdiction governing data based on where it is physically stored
Data sovereignty means the laws of the country where data physically resides apply to it, which affects what legal process US investigators must follow to access data stored abroad.
Question 2: Which artifact on an Android device stores SMS and MMS messages that a forensic investigator should examine?
- contacts2.db
- mmssms.db (Correct answer)
- calendar.db
- accounts.db
Correct answer: mmssms.db
The mmssms.db SQLite database on Android devices stores all SMS and MMS messages, making it a primary target for communication evidence in mobile forensics.
Question 3: What is the significance of 'EXIF metadata' embedded in photos from a mobile device in a forensic investigation?
- It stores the device's encryption keys
- It contains GPS coordinates, timestamps, and device information that corroborate or contradict a suspect's alibi (Correct answer)
- It holds the user's cloud account credentials
- It logs every app installation
Correct answer: It contains GPS coordinates, timestamps, and device information that corroborate or contradict a suspect's alibi
EXIF metadata in photos records GPS location, date/time, camera model, and settings, providing investigators with powerful corroborating or contradicting evidence for a suspect's location and timeline.
Question 4: Which cloud storage service log would be MOST useful for determining when a suspect uploaded files to a shared drive?
- Server CPU utilization logs
- Cloud provider audit/access logs (e.g., AWS CloudTrail, Google Workspace audit logs) (Correct answer)
- Network switch port statistics
- Email server bounce logs
Correct answer: Cloud provider audit/access logs (e.g., AWS CloudTrail, Google Workspace audit logs)
Cloud provider audit logs record specific API calls, file uploads, access events, and user actions with timestamps, directly evidencing when and what a user uploaded.
Question 5: During mobile forensics, what is 'app data sandboxing' and how does it affect evidence collection?
- A testing environment for malware analysis
- iOS/Android isolation of each app's data in its own directory, limiting cross-app access and requiring elevated privileges to extract (Correct answer)
- A cloud backup mechanism for app settings
- A feature that deletes app data after 30 days
Correct answer: iOS/Android isolation of each app's data in its own directory, limiting cross-app access and requiring elevated privileges to extract
App sandboxing restricts each app's data to its own protected directory; forensic investigators typically need a jailbreak/root or physical extraction to access sandboxed app data from competing apps.
Question 6: What is the primary forensic challenge with end-to-end encrypted messaging apps like Signal on a mobile device?
- They store messages in plain text on the server
- Messages are only decryptable on the endpoint device; cloud servers hold no readable content (Correct answer)
- They automatically back up to iCloud in plaintext
- They disable the device camera
Correct answer: Messages are only decryptable on the endpoint device; cloud servers hold no readable content
End-to-end encryption ensures only the communicating devices hold decryption keys, so investigators must acquire the physical device to access message content—server-side requests yield only encrypted ciphertext.
CDFI CDFI Mobile Device & Cloud Forensics 2
In cloud forensics, what does 'data sovereignty' mean and why is it forensically significant?