CHFI Mobile Device Forensics 2

Question 1

Which iOS feature encrypts the file system key with a passcode-derived key, making data inaccessible without the correct passcode?

Accepted Answer

Data Protection

Answer

iOS Data Protection ties file encryption keys to the user's passcode, rendering data unreadable when the device is locked.

Question 2

An investigator finds a deleted SMS on an Android device by examining raw NAND flash blocks. What technique is being used?

Accepted Answer

Chip-off forensics

Answer

Chip-off forensics involves physically removing the NAND flash chip and reading its raw contents, allowing recovery of deleted data.

Question 3

Which database format stores the majority of application data, call logs, and messages on both iOS and Android devices?

Accepted Answer

SQLite

Answer

SQLite is the primary relational database engine used by mobile operating systems to store structured application data.

Question 4

A forensic examiner wants to extract data from a locked Android device using the JTAG method. What does this technique access?

Accepted Answer

Raw memory via test access ports

Answer

JTAG accesses the device's memory by connecting to Joint Test Action Group debug ports on the motherboard.

Question 5

What iOS artifact contains a history of locations visited by the device, stored as a SQLite database?

Accepted Answer

consolidated.db

Answer

Historically, consolidated.db stored location history on iOS devices and became a major forensic artifact.

CHFI - Computer Hacking Forensic Investigator Practice Test