EnCE Mobile Forensics 4

Question 1

What is the primary advantage of a chip-off acquisition compared to JTAG in mobile forensics?

Accepted Answer

It can acquire data even when JTAG test points are disabled or inaccessible

Answer

Chip-off allows memory extraction by physically removing the NAND chip, bypassing any port-level restrictions that would block JTAG.

Question 2

An examiner uses EnCase to analyze a mobile device and discovers the file '/data/system/locksettings.db'. What is the forensic significance of this file?

Accepted Answer

It stores the current screen lock credential type and related security settings

Answer

The locksettings.db database stores the device's lock screen credential type, PIN/password hash reference, and related security configuration.

Question 3

When examining iOS app data in EnCase, what encoding format is most commonly used to store binary property list (plist) files?

Accepted Answer

Binary format with 'bplist00' magic bytes

Answer

Binary plist files begin with the magic bytes 'bplist00' and use Apple's compact binary serialization format rather than plain XML.

Question 4

Which EnCase feature helps an examiner identify common mobile artifact locations automatically during evidence processing?

Accepted Answer

Mobile Artifact Parser within the Evidence Processor

Answer

EnCase's Evidence Processor includes a Mobile Artifact Parser that automatically identifies and extracts known mobile artifacts like call logs and messages.

Question 5

What is a 'logical acquisition' limitation that makes it insufficient for a thorough EnCE mobile investigation?

Accepted Answer

It does not recover deleted files or data from unallocated space

Answer

Logical acquisition only retrieves currently allocated and accessible files, missing deleted data and artifacts in unallocated areas.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Mobile Forensics 4