EnCE Mobile Forensics 3

Question 1

When examining an iTunes backup in EnCase, which file format stores most of the backup data with hashed filenames?

Accepted Answer

Files named with SHA-1 hashes of their original paths

Answer

iTunes backups store files using SHA-1 hashes derived from the original file's domain and relative path as filenames.

Question 2

Which EnCase tool or method is used to recover deleted records from an SQLite database on a mobile device?

Accepted Answer

Carving unallocated space within SQLite page files for old record fragments

Answer

Deleted SQLite records often remain in unallocated pages or free lists within the database file, recoverable through page-level carving.

Question 3

What information is typically found in the 'knowledgec.db' file on an iOS device?

Accepted Answer

App usage history, device pickups, and screen-on/off events

Answer

KnowledgeC.db is part of the KBSYNCEDLOCALKB domain and tracks app usage, device interaction patterns, and screen activity.

Question 4

An EnCase examiner is analyzing a Samsung Android device using a physical image. What file system is most commonly found on the internal storage partition?

Accepted Answer

EXT4

Answer

Modern Android devices, including Samsung, use EXT4 as the primary file system for internal data partitions.

Question 5

Which artifact on an iOS device would an EnCE examiner examine to find a list of all wireless networks the device has previously connected to?

Accepted Answer

com.apple.wifi.known-networks.plist

Answer

The com.apple.wifi.known-networks.plist file stores SSIDs, BSSIDs, and timestamps of previously joined Wi-Fi networks.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Mobile Forensics 3