CDFI CDFI Mobile Device & Cloud Forensics 2

Question 1

In cloud forensics, what does 'data sovereignty' mean and why is it forensically significant?

Accepted Answer

The legal jurisdiction governing data based on where it is physically stored

Answer

Data sovereignty means the laws of the country where data physically resides apply to it, which affects what legal process US investigators must follow to access data stored abroad.

Question 2

Which artifact on an Android device stores SMS and MMS messages that a forensic investigator should examine?

Accepted Answer

mmssms.db

Answer

The mmssms.db SQLite database on Android devices stores all SMS and MMS messages, making it a primary target for communication evidence in mobile forensics.

Question 3

What is the significance of 'EXIF metadata' embedded in photos from a mobile device in a forensic investigation?

Accepted Answer

It contains GPS coordinates, timestamps, and device information that corroborate or contradict a suspect's alibi

Answer

EXIF metadata in photos records GPS location, date/time, camera model, and settings, providing investigators with powerful corroborating or contradicting evidence for a suspect's location and timeline.

Question 4

Which cloud storage service log would be MOST useful for determining when a suspect uploaded files to a shared drive?

Accepted Answer

Cloud provider audit/access logs (e.g., AWS CloudTrail, Google Workspace audit logs)

Answer

Cloud provider audit logs record specific API calls, file uploads, access events, and user actions with timestamps, directly evidencing when and what a user uploaded.

Question 5

During mobile forensics, what is 'app data sandboxing' and how does it affect evidence collection?

Accepted Answer

iOS/Android isolation of each app's data in its own directory, limiting cross-app access and requiring elevated privileges to extract

Answer

App sandboxing restricts each app's data to its own protected directory; forensic investigators typically need a jailbreak/root or physical extraction to access sandboxed app data from competing apps.

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI - Certified Digital Forensics Investigator Practice Test

CDFI CDFI Mobile Device & Cloud Forensics 2