CDFI CDFI Mobile Device & Cloud Forensics 1 — Questions and Answers
Question 1: Which extraction method provides the most complete data from a modern locked Android device during a CDFI investigation?
- Logical extraction via USB debugging
- Physical extraction using chip-off or JTAG methods (Correct answer)
- Manual photography of the screen
- SIM card cloning
Correct answer: Physical extraction using chip-off or JTAG methods
Physical extraction methods like chip-off or JTAG access raw flash memory, bypassing device locks to obtain the most complete dataset including deleted data.
Question 2: What does 'logical extraction' of a mobile device produce in a forensic investigation?
- A bit-for-bit copy of the flash memory
- An export of accessible files and databases through the device's OS interface (Correct answer)
- A decrypted copy of the SIM card
- A hardware-level dump of RAM
Correct answer: An export of accessible files and databases through the device's OS interface
Logical extraction interfaces with the device's operating system to export accessible files, contacts, messages, and app data without bypassing security controls.
Question 3: Which forensic tool is widely recognized for mobile device acquisition and analysis in the US law enforcement community?
- Autopsy
- Cellebrite UFED (Correct answer)
- Volatility
- FTK Imager
Correct answer: Cellebrite UFED
Cellebrite UFED (Universal Forensic Extraction Device) is the industry-leading tool used by US law enforcement for mobile device data extraction and analysis.
Question 4: When acquiring cloud data during a CDFI investigation, what is the legally required mechanism to compel a US cloud provider to disclose customer data?
- A verbal request from law enforcement
- A valid legal process such as a court order, warrant, or subpoena (Correct answer)
- An administrative password reset
- A network traffic capture from the provider's datacenter
Correct answer: A valid legal process such as a court order, warrant, or subpoena
Under the Stored Communications Act, US providers must comply with valid court orders, warrants, or subpoenas before disclosing subscriber content or non-content data.
Question 5: What type of data is typically found in an iOS device's 'iTunes backup' that is valuable for forensic analysis?
- Kernel crash dumps only
- Contacts, messages, app data, photos, and call history (Correct answer)
- Bootloader firmware exclusively
- CPU performance counters
Correct answer: Contacts, messages, app data, photos, and call history
An iTunes/Finder backup contains contacts, SMS/iMessages, photos, call history, app data, and device settings, making it a rich forensic artifact even without physical access.
Question 6: What is 'faraday shielding' used for when handling a suspect's mobile device at the scene?
- Charging the device battery safely
- Blocking wireless signals to prevent remote wipe or data alteration (Correct answer)
- Encrypting the device's storage
- Unlocking the device's bootloader
Correct answer: Blocking wireless signals to prevent remote wipe or data alteration
A Faraday bag or cage blocks cellular, Wi-Fi, and Bluetooth signals, preventing the device from receiving remote wipe commands or new data that could alter evidence.
CDFI CDFI Mobile Device & Cloud Forensics 1
Which extraction method provides the most complete data from a modern locked Android device during a CDFI investigation?