Mobile Device Forensics Flashcards

Which iOS feature encrypts the file system key with a passcode-derived key, making data inaccessible without the correct passcode?

Answer: Data Protection

iOS Data Protection ties file encryption keys to the user's passcode, rendering data unreadable when the device is locked.

An investigator finds a deleted SMS on an Android device by examining raw NAND flash blocks. What technique is being used?

Answer: Chip-off forensics

Chip-off forensics involves physically removing the NAND flash chip and reading its raw contents, allowing recovery of deleted data.

Which database format stores the majority of application data, call logs, and messages on both iOS and Android devices?

Answer: SQLite

SQLite is the primary relational database engine used by mobile operating systems to store structured application data.

A forensic examiner wants to extract data from a locked Android device using the JTAG method. What does this technique access?

Answer: Raw memory via test access ports

JTAG accesses the device's memory by connecting to Joint Test Action Group debug ports on the motherboard.

What iOS artifact contains a history of locations visited by the device, stored as a SQLite database?

Answer: consolidated.db

Historically, consolidated.db stored location history on iOS devices and became a major forensic artifact.

Which Android acquisition method provides the most complete data extraction, including deleted files, but requires the device to be rooted?

Answer: Physical acquisition

Physical acquisition creates a bit-for-bit image of the storage medium and can recover deleted data, but typically requires root access.

During mobile forensics, an examiner discovers a file named 'mmssms.db' on an Android device. What does this file contain?

Answer: SMS and MMS message history

The mmssms.db SQLite database stores SMS and MMS messages on Android devices.