CHFI Mobile Device Forensics 4

Question 1

A CHFI investigator examines a suspect's iPhone backup stored on a Windows PC. Where are iTunes backups located by default?

Accepted Answer

C:\Users\<user>\AppData\Roaming\Apple Computer\MobileSync\Backup

Answer

iTunes stores iPhone backups in the AppData\Roaming\Apple Computer\MobileSync\Backup directory on Windows.

Question 2

What is the significance of the 'Manifest.db' file found in an iOS iTunes backup?

Accepted Answer

Maps hashed backup file names to original file paths and metadata

Answer

Manifest.db is a SQLite database that maps the SHA1-hashed filenames in the backup to their original file paths and metadata.

Question 3

Which mobile forensic artifact on Android contains a record of all installed packages, their permissions, and signing certificates?

Accepted Answer

/data/system/packages.xml

Answer

The packages.xml file in /data/system/ maintains a registry of all installed applications, their permissions, and signing certificates.

Question 4

During a CHFI investigation, an examiner recovers WhatsApp messages from an Android device. Where is the WhatsApp message database typically stored?

Accepted Answer

/data/data/com.whatsapp/databases/msgstore.db

Answer

WhatsApp stores its message database at /data/data/com.whatsapp/databases/msgstore.db, which requires root access to read directly.

Question 5

What does the term 'acquisition window' refer to in mobile device forensics?

Accepted Answer

The period between seizure and examination during which volatile data may be lost

Answer

The acquisition window is the critical period between device seizure and examination during which volatile evidence (RAM, cache) can degrade or be lost.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Mobile Device Forensics 4