EnCE Mobile Forensics 2 — Questions and Answers
Question 1: Which EnCase feature allows an examiner to parse SQLite databases found on an Android device without exporting them?
- Evidence Processor
- EnScript with SQLite library (Correct answer)
- Physical Disk Emulator
- Logical Evidence File viewer
Correct answer: EnScript with SQLite library
EnScript provides a built-in SQLite library that can parse SQLite database files directly from within the case.
Question 2: When performing a logical acquisition of an iOS device using EnCase, which protocol is primarily used to communicate with the device?
- MTP (Media Transfer Protocol)
- ADB (Android Debug Bridge)
- AFC (Apple File Conduit) (Correct answer)
- PTP (Picture Transfer Protocol)
Correct answer: AFC (Apple File Conduit)
EnCase communicates with iOS devices using the Apple File Conduit (AFC) protocol over the USB connection.
Question 3: What is the purpose of the 'keybag' file found in iOS device backups examined in EnCase?
- It stores the device's Wi-Fi passwords
- It contains wrapped encryption keys for the backup's protected files (Correct answer)
- It holds the device's contact list
- It logs all keystrokes entered on the device
Correct answer: It contains wrapped encryption keys for the backup's protected files
The keybag file stores the class keys used to wrap (encrypt) individual file encryption keys within a protected iOS backup.
Question 4: An examiner finds a .db-wal file alongside an SQLite database on a seized Android phone. What does this file represent?
- A write-ahead log containing uncommitted or recent transactions (Correct answer)
- A corrupted backup of the main database
- A Windows Artifact Log unrelated to SQLite
- An encrypted shadow copy of the database
Correct answer: A write-ahead log containing uncommitted or recent transactions
The .db-wal file is SQLite's Write-Ahead Log, containing transactions that may not yet be committed to the main database file.
Question 5: Which Android directory typically stores application-specific private data such as SharedPreferences and internal databases?
- /sdcard/Android/data/
- /data/data/<package_name>/ (Correct answer)
- /system/app/
- /proc/net/
Correct answer: /data/data/<package_name>/
The /data/data/<package_name>/ directory holds private application data including databases, preferences, and cache files.
Question 6: During mobile forensics, what does the term 'JTAG acquisition' refer to?
- A logical pull of app data via the device's USB debugging mode
- A hardware-level technique using test access ports to read raw flash memory (Correct answer)
- A cloud-based extraction of device backups from a vendor server
- A chip-off method requiring physical removal of the NAND chip
Correct answer: A hardware-level technique using test access ports to read raw flash memory
JTAG acquisition uses the device's Joint Test Action Group (JTAG) test access ports to read raw memory contents without chip removal.
Question 7: In EnCase, after acquiring a mobile device image, which artifact type would most likely contain SMS/MMS message history on an Android device?
- mmssms.db SQLite database (Correct answer)
- contacts2.db SQLite database
- telephony.xml preference file
- cellular.plist binary file
Correct answer: mmssms.db SQLite database
Android stores SMS and MMS messages in the mmssms.db SQLite database located within the telephony provider's data directory.
EnCE Mobile Forensics 2
Which EnCase feature allows an examiner to parse SQLite databases found on an Android device without exporting them?