EnCE Mobile Forensics 2

Question 1

Which EnCase feature allows an examiner to parse SQLite databases found on an Android device without exporting them?

Accepted Answer

EnScript with SQLite library

Answer

EnScript provides a built-in SQLite library that can parse SQLite database files directly from within the case.

Question 2

When performing a logical acquisition of an iOS device using EnCase, which protocol is primarily used to communicate with the device?

Accepted Answer

AFC (Apple File Conduit)

Answer

EnCase communicates with iOS devices using the Apple File Conduit (AFC) protocol over the USB connection.

Question 3

What is the purpose of the 'keybag' file found in iOS device backups examined in EnCase?

Accepted Answer

It contains wrapped encryption keys for the backup's protected files

Answer

The keybag file stores the class keys used to wrap (encrypt) individual file encryption keys within a protected iOS backup.

Question 4

An examiner finds a .db-wal file alongside an SQLite database on a seized Android phone. What does this file represent?

Accepted Answer

A write-ahead log containing uncommitted or recent transactions

Answer

The .db-wal file is SQLite's Write-Ahead Log, containing transactions that may not yet be committed to the main database file.

Question 5

Which Android directory typically stores application-specific private data such as SharedPreferences and internal databases?

Accepted Answer

/data/data/<package_name>/

Answer

The /data/data/<package_name>/ directory holds private application data including databases, preferences, and cache files.

(EnCE) EnCase Certified Examiner Practice Test