CHFI - Computer Hacking Forensic Investigator Mobile Device Forensics Questions and Answers

Question 1

An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field.
To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?

Accepted Answer

Logical acquisition

Answer

Chip-off acquisition

Answer

Physical acquisition

Answer

JTAG acquisition

Question 2

A forensic examiner is analyzing a full file system extraction of an iPhone. In which of the following SQLite database files would the examiner most likely find a comprehensive record of SMS, MMS, and iMessage communications?

Accepted Answer

/private/var/mobile/Library/SMS/sms.db

Answer

/private/var/mobile/Library/Accounts/Accounts3.sqlite

Answer

/private/var/root/Library/Caches/locationd/consolidated.db

Answer

/private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db

Question 3

A forensic investigator is attempting to extract data from a severely damaged smartphone that will not power on. The device's motherboard is cracked, making JTAG and ISP methods impossible. Which of the following is the most appropriate, albeit destructive, technique to attempt data recovery?

Accepted Answer

Chip-off

Answer

Logical acquisition

Answer

File system acquisition

Answer

Manual acquisition

Question 4

Which of the following unique identifiers is permanently associated with the mobile device's hardware and is used by cellular networks to identify and potentially block a stolen or unauthorized device?

Accepted Answer

IMEI (International Mobile Equipment Identity)

Answer

IMSI (International Mobile Subscriber Identity)

Answer

ICCID (Integrated Circuit Card Identifier)

Answer

MSISDN (Mobile Station International Subscriber Directory Number)

Question 5

A suspect claims to have only stored a few contacts on their SIM card and that the phone's internal memory is irrelevant. Why is this statement often misleading in the context of modern smartphone forensics?

Accepted Answer

Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card.

Answer

SIM cards are read-only and cannot be used to store any user-generated data like contacts.

Answer

All data saved to a SIM card is automatically and permanently deleted after 30 days.

Answer

The IMEI number of the phone is stored on the SIM card, linking all activity to the subscriber.

Question 6

The security model of a particular mobile operating system is often described as a 'walled garden,' where the manufacturer controls the hardware, firmware, operating system, and application distribution. This model presents a significant challenge for forensic examiners trying to gain deep file system access. Which operating system is most famously associated with this model?

Accepted Answer

iOS

Answer

Symbian

Answer

Android

Answer

Windows Phone