CHFI - Computer Hacking Forensic Investigator Mobile Device Forensics Questions and Answers

Question 1

An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field. To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?

Accepted Answer

Logical acquisition

Answer

Logical acquisition is the fastest and least invasive method, ideal for a preliminary field examination of an unlocked device. It copies files and data accessible through the standard user interface, which includes contacts, call logs, and messages. Physical, JTAG, and Chip-off methods are much more invasive, time-consuming, and complex, typically reserved for laboratory analysis.

Question 2

A forensic examiner is analyzing a full file system extraction of an iPhone. In which of the following SQLite database files would the examiner most likely find a comprehensive record of SMS, MMS, and iMessage communications?

Accepted Answer

/private/var/mobile/Library/SMS/sms.db

Answer

The sms.db file, located at /private/var/mobile/Library/SMS/, is the primary SQLite database on iOS devices for storing all SMS, MMS, and iMessage data. The other paths are for account information (Accounts3.sqlite), historical location data (consolidated.db), and general user activity logs (knowledgeC.db).

Question 3

A forensic investigator is attempting to extract data from a severely damaged smartphone that will not power on. The device's motherboard is cracked, making JTAG and ISP methods impossible. Which of the following is the most appropriate, albeit destructive, technique to attempt data recovery?

Accepted Answer

Chip-off

Answer

Chip-off is an advanced, invasive forensic technique where the flash memory chip is physically de-soldered from the circuit board and read with a specialized device. It is considered a last resort when the device is non-functional and other methods like JTAG are not viable due to physical damage. The other methods require a functioning or at least partially functioning device.

Question 4

Which of the following unique identifiers is permanently associated with the mobile device's hardware and is used by cellular networks to identify and potentially block a stolen or unauthorized device?

Accepted Answer

IMEI (International Mobile Equipment Identity)

Answer

The IMEI (International Mobile Equipment Identity) is a unique 15-digit number that identifies the physical mobile device hardware. Networks use the IMEI to track and block devices. In contrast, the IMSI is tied to the subscriber's SIM card, the ICCID is the SIM card's serial number, and the MSISDN is the user's phone number.

Question 5

A suspect claims to have only stored a few contacts on their SIM card and that the phone's internal memory is irrelevant. Why is this statement often misleading in the context of modern smartphone forensics?

Accepted Answer

Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card.

Answer

While older feature phones had limited capacity to store contacts and SMS messages on a SIM card, modern smartphones use their large internal flash memory to store vast amounts of data, including comprehensive contact details, call logs, and entire message conversations. The SIM card's role is primarily to store subscriber identity information.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Mobile Device Forensics Questions and Answers