EnCE Mobile Forensics 5 — Questions and Answers
Question 1: What role does the 'Manifest.db' file play in an iTunes backup examined with EnCase?
- It stores the encrypted backup password hash
- It maps SHA-1 hashed filenames to their original paths and domains (Correct answer)
- It contains the device's UDID and serial number only
- It records the sync timestamp and iTunes version
Correct answer: It maps SHA-1 hashed filenames to their original paths and domains
Manifest.db is an SQLite database that maps each hashed backup file to its original file path, domain, and metadata within the iTunes backup.
Question 2: During an EnCase investigation, an examiner analyzes the 'DataUsage.sqlite' file from an iOS device. What type of evidence can this provide?
- Per-app network data usage statistics and timestamps (Correct answer)
- A log of all Safari downloads with URLs
- Records of in-app purchases made through the App Store
- A history of iCloud synchronization events
Correct answer: Per-app network data usage statistics and timestamps
DataUsage.sqlite tracks cellular and Wi-Fi data consumption per application, including timestamps of activity that can corroborate app usage timelines.
Question 3: Which hashing algorithm does EnCase use by default to verify the integrity of a mobile device acquisition?
- CRC32
- MD5 and/or SHA-1 (Correct answer)
- SHA-256 exclusively
- Adler-32
Correct answer: MD5 and/or SHA-1
EnCase computes both MD5 and SHA-1 hashes by default to verify acquisition integrity and ensure the image matches the original source.
Question 4: An examiner discovers a 'cache.db' file within an iOS app's Library/Caches directory. What type of forensic data might this contain?
- Encrypted user credentials for the application
- HTTP request and response data including URLs and content (Correct answer)
- The app's complete source code
- Push notification tokens and payloads
Correct answer: HTTP request and response data including URLs and content
The cache.db file is used by iOS's URL caching system (NSURLCache) and may contain HTTP request/response pairs including URLs, headers, and body content.
Question 5: What is the forensic significance of the Android 'userdata' partition in an EnCase mobile investigation?
- It contains the Android OS kernel and bootloader
- It stores user-installed apps, personal data, accounts, and most forensic artifacts (Correct answer)
- It holds the device's radio firmware and baseband configuration
- It exclusively stores the device's external SD card mirror
Correct answer: It stores user-installed apps, personal data, accounts, and most forensic artifacts
The userdata partition contains installed applications, user files, databases, credentials, and most evidentiary artifacts critical to mobile forensic investigations.
Question 6: When analyzing a mobile device's call logs in EnCase, which Android database file would the examiner typically target?
- telephony/mmssms.db
- contacts2.db or calllog.db (Correct answer)
- dialer/history.xml
- system/phone_log.sqlite
Correct answer: contacts2.db or calllog.db
Android call logs are stored in the contacts2.db or a separate calllog.db file managed by the CallLog content provider.
Question 7: Which EnCase capability allows an examiner to view the logical file structure of a mobile device image organized by app rather than raw directory path?
- Timeline view sorted by file extension
- Artifact view or parsed mobile report grouping data by application (Correct answer)
- Entropy map visualization
- Hash analysis by file type
Correct answer: Artifact view or parsed mobile report grouping data by application
EnCase's mobile artifact reporting organizes extracted data by application category (e.g., WhatsApp, contacts, browser), making analysis more efficient.
EnCE Mobile Forensics 5
What role does the 'Manifest.db' file play in an iTunes backup examined with EnCase?