EnCE Mobile Forensics 4 — Questions and Answers
Question 1: What is the primary advantage of a chip-off acquisition compared to JTAG in mobile forensics?
- It is non-destructive and preserves the device for further examination
- It can acquire data even when JTAG test points are disabled or inaccessible (Correct answer)
- It only requires free forensic software to execute
- It automatically decrypts full-disk encryption
Correct answer: It can acquire data even when JTAG test points are disabled or inaccessible
Chip-off allows memory extraction by physically removing the NAND chip, bypassing any port-level restrictions that would block JTAG.
Question 2: An examiner uses EnCase to analyze a mobile device and discovers the file '/data/system/locksettings.db'. What is the forensic significance of this file?
- It stores the current screen lock credential type and related security settings (Correct answer)
- It contains a list of all installed applications and their permissions
- It records GPS location data linked to lock/unlock events
- It holds encrypted copies of all files protected by Android's file-based encryption
Correct answer: It stores the current screen lock credential type and related security settings
The locksettings.db database stores the device's lock screen credential type, PIN/password hash reference, and related security configuration.
Question 3: When examining iOS app data in EnCase, what encoding format is most commonly used to store binary property list (plist) files?
- UTF-16 with BOM header
- Binary format with 'bplist00' magic bytes (Correct answer)
- Base64-encoded XML
- Gzip-compressed JSON
Correct answer: Binary format with 'bplist00' magic bytes
Binary plist files begin with the magic bytes 'bplist00' and use Apple's compact binary serialization format rather than plain XML.
Question 4: Which EnCase feature helps an examiner identify common mobile artifact locations automatically during evidence processing?
- RAID reconstruction module
- Mobile Artifact Parser within the Evidence Processor (Correct answer)
- Network packet analyzer
- Registry viewer
Correct answer: Mobile Artifact Parser within the Evidence Processor
EnCase's Evidence Processor includes a Mobile Artifact Parser that automatically identifies and extracts known mobile artifacts like call logs and messages.
Question 5: What is a 'logical acquisition' limitation that makes it insufficient for a thorough EnCE mobile investigation?
- It produces images that cannot be analyzed by EnCase
- It does not recover deleted files or data from unallocated space (Correct answer)
- It requires the device to be in airplane mode
- It only works on iOS devices, not Android
Correct answer: It does not recover deleted files or data from unallocated space
Logical acquisition only retrieves currently allocated and accessible files, missing deleted data and artifacts in unallocated areas.
Question 6: In Android forensics, what does the presence of the file '/data/misc/adb/adb_keys' indicate?
- The device has been factory reset
- One or more computers have been authorized for ADB access to the device (Correct answer)
- The device uses ADB over TCP/IP exclusively
- The ADB daemon is currently disabled
Correct answer: One or more computers have been authorized for ADB access to the device
The adb_keys file stores the RSA public keys of computers that have been granted ADB access authorization by the device user.
Question 7: When examining a mobile device image in EnCase, an examiner finds EXIF metadata embedded in photos. Which piece of EXIF data is most forensically valuable for establishing location?
- Color space and bit depth values
- GPS latitude, longitude, and altitude coordinates (Correct answer)
- Camera make and model information
- Image compression ratio
Correct answer: GPS latitude, longitude, and altitude coordinates
EXIF GPS coordinates directly embed the geographic location where a photo was captured, providing strong location evidence.
EnCE Mobile Forensics 4
What is the primary advantage of a chip-off acquisition compared to JTAG in mobile forensics?