CDFI CDFI Mobile Device & Cloud Forensics

Question 1

Which extraction method provides the most complete data from a modern locked Android device during a CDFI investigation?

Accepted Answer

Physical extraction using chip-off or JTAG methods

Answer

Logical extraction via USB debugging

Answer

Manual photography of the screen

Answer

SIM card cloning

Question 2

What does 'logical extraction' of a mobile device produce in a forensic investigation?

Accepted Answer

An export of accessible files and databases through the device's OS interface

Answer

A bit-for-bit copy of the flash memory

Answer

A decrypted copy of the SIM card

Answer

A hardware-level dump of RAM

Question 3

Which forensic tool is widely recognized for mobile device acquisition and analysis in the US law enforcement community?

Accepted Answer

Cellebrite UFED

Answer

Autopsy

Answer

Volatility

Answer

FTK Imager

Question 4

When acquiring cloud data during a CDFI investigation, what is the legally required mechanism to compel a US cloud provider to disclose customer data?

Accepted Answer

A valid legal process such as a court order, warrant, or subpoena

Answer

A verbal request from law enforcement

Answer

An administrative password reset

Answer

A network traffic capture from the provider's datacenter

Question 5

What type of data is typically found in an iOS device's 'iTunes backup' that is valuable for forensic analysis?

Accepted Answer

Contacts, messages, app data, photos, and call history

Answer

Kernel crash dumps only

Answer

Bootloader firmware exclusively

Answer

CPU performance counters

Question 6

What is 'faraday shielding' used for when handling a suspect's mobile device at the scene?

Accepted Answer

Blocking wireless signals to prevent remote wipe or data alteration

Answer

Charging the device battery safely

Answer

Encrypting the device's storage

Answer

Unlocking the device's bootloader