EnCE Mobile Forensics 3 — Questions and Answers
Question 1: When examining an iTunes backup in EnCase, which file format stores most of the backup data with hashed filenames?
- Flat XML property list files
- Files named with SHA-1 hashes of their original paths (Correct answer)
- ZIP archives organized by app bundle ID
- Encrypted APFS volumes
Correct answer: Files named with SHA-1 hashes of their original paths
iTunes backups store files using SHA-1 hashes derived from the original file's domain and relative path as filenames.
Question 2: Which EnCase tool or method is used to recover deleted records from an SQLite database on a mobile device?
- Entropy analysis of the database header
- Carving unallocated space within SQLite page files for old record fragments (Correct answer)
- Recovering the database from the device's recycle bin
- Rebuilding the B-tree index using the .db-shm file
Correct answer: Carving unallocated space within SQLite page files for old record fragments
Deleted SQLite records often remain in unallocated pages or free lists within the database file, recoverable through page-level carving.
Question 3: What information is typically found in the 'knowledgec.db' file on an iOS device?
- App usage history, device pickups, and screen-on/off events (Correct answer)
- Safari browsing history and bookmarks
- iCloud keychain credentials
- Call logs and FaceTime records
Correct answer: App usage history, device pickups, and screen-on/off events
KnowledgeC.db is part of the KBSYNCEDLOCALKB domain and tracks app usage, device interaction patterns, and screen activity.
Question 4: An EnCase examiner is analyzing a Samsung Android device using a physical image. What file system is most commonly found on the internal storage partition?
- FAT32
- NTFS
- EXT4 (Correct answer)
- HFS+
Correct answer: EXT4
Modern Android devices, including Samsung, use EXT4 as the primary file system for internal data partitions.
Question 5: Which artifact on an iOS device would an EnCE examiner examine to find a list of all wireless networks the device has previously connected to?
- com.apple.wifi.known-networks.plist (Correct answer)
- com.apple.network.identification.plist
- SCDynamicStore/com.apple.wifi.plist
- SystemConfiguration/NetworkInterfaces.plist
Correct answer: com.apple.wifi.known-networks.plist
The com.apple.wifi.known-networks.plist file stores SSIDs, BSSIDs, and timestamps of previously joined Wi-Fi networks.
Question 6: During mobile forensic analysis, what does GrayKey primarily accomplish that standard logical acquisition cannot?
- It creates a forensic hash of the physical device image
- It bypasses the iOS passcode to enable a full file system extraction (Correct answer)
- It clones the device SIM card for carrier analysis
- It decrypts iCloud backups using the Apple ID credentials
Correct answer: It bypasses the iOS passcode to enable a full file system extraction
GrayKey exploits iOS vulnerabilities to bypass the passcode lock, enabling full file system extraction that is otherwise protected.
Question 7: In the context of Android forensics with EnCase, what is the significance of the 'accounts.db' or 'accounts_ce.db' file?
- It stores financial transaction records from banking apps
- It contains synced Google and third-party account credentials and tokens (Correct answer)
- It logs all failed unlock attempts with timestamps
- It holds the device's built-in calculator history
Correct answer: It contains synced Google and third-party account credentials and tokens
The accounts_ce.db file stores registered accounts (Google, social media, etc.) and associated authentication tokens on the device.
EnCE Mobile Forensics 3
When examining an iTunes backup in EnCase, which file format stores most of the backup data with hashed filenames?