CHFI Mobile Device Forensics 5

Question 1

What is the primary forensic challenge posed by Apple's 'Secure Enclave Processor' (SEP) in modern iPhones?

Accepted Answer

It stores encryption keys that cannot be extracted even by Apple

Answer

The SEP stores cryptographic keys in hardware that are never exposed to the main OS, making brute-force attacks the only viable method.

Question 2

A forensic examiner is analyzing an Android device and finds the file '/data/system/gesture.key'. What does this file contain?

Accepted Answer

A SHA1 hash of the screen unlock pattern

Answer

gesture.key contains an unsalted SHA1 hash of the Android unlock pattern, which can potentially be cracked offline.

Question 3

Which mobile forensic technique involves using specialized hardware clips to read flash memory without desoldering the chip?

Accepted Answer

ISP (In-System Programming)

Answer

ISP (In-System Programming) uses test pads on the PCB to read flash memory directly without removing the chip.

Question 4

During iOS forensic analysis, what is the forensic significance of the 'KnowledgeC.db' database?

Accepted Answer

Records app usage, device wake/sleep events, and location data with timestamps

Answer

KnowledgeC.db is an iOS Core Data store that tracks app usage patterns, device states, and user activities with precise timestamps.

Question 5

What does 'GrayKey' primarily enable in mobile forensics investigations?

Accepted Answer

Physical extraction and passcode bypass on iPhones

Answer

GrayKey is a law enforcement tool developed by Grayshift that enables passcode brute-forcing and physical data extraction from iPhones.

CHFI - Computer Hacking Forensic Investigator Practice Test