CHFI Mobile Device Forensics 3

Question 1

What is the primary purpose of a Faraday bag in mobile device forensics?

Accepted Answer

Block electromagnetic signals to prevent remote wipe

Answer

A Faraday bag shields the device from cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe commands from reaching it.

Question 2

Which Apple forensic artifact records the last known location of an iOS device along with timestamps and accuracy radius?

Accepted Answer

routined database

Answer

The routined daemon manages significant location tracking on iOS, storing data in its associated database files.

Question 3

An investigator needs to bypass Android's FRP (Factory Reset Protection) lock during forensic examination. What is the primary challenge FRP presents?

Accepted Answer

Requires original Google account credentials to activate after reset

Answer

FRP requires the original Google account credentials to be entered after a factory reset, preventing unauthorized activation of the device.

Question 4

Which iOS file system partition contains the user's data, installed apps, and forensically relevant artifacts?

Accepted Answer

/private/var

Answer

The /private/var partition (user data partition) on iOS contains all user-generated data, app data, and forensic artifacts.

Question 5

What Android debug feature, when enabled, allows forensic tools to communicate with a device via USB for data extraction?

Accepted Answer

ADB (Android Debug Bridge)

Answer

ADB (Android Debug Bridge) is a command-line tool that enables communication between a computer and an Android device for extraction and analysis.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Mobile Device Forensics 3