EnCE Mobile Forensics 5

Question 1

What role does the 'Manifest.db' file play in an iTunes backup examined with EnCase?

Accepted Answer

It maps SHA-1 hashed filenames to their original paths and domains

Answer

Manifest.db is an SQLite database that maps each hashed backup file to its original file path, domain, and metadata within the iTunes backup.

Question 2

During an EnCase investigation, an examiner analyzes the 'DataUsage.sqlite' file from an iOS device. What type of evidence can this provide?

Accepted Answer

Per-app network data usage statistics and timestamps

Answer

DataUsage.sqlite tracks cellular and Wi-Fi data consumption per application, including timestamps of activity that can corroborate app usage timelines.

Question 3

Which hashing algorithm does EnCase use by default to verify the integrity of a mobile device acquisition?

Accepted Answer

MD5 and/or SHA-1

Answer

EnCase computes both MD5 and SHA-1 hashes by default to verify acquisition integrity and ensure the image matches the original source.

Question 4

An examiner discovers a 'cache.db' file within an iOS app's Library/Caches directory. What type of forensic data might this contain?

Accepted Answer

HTTP request and response data including URLs and content

Answer

The cache.db file is used by iOS's URL caching system (NSURLCache) and may contain HTTP request/response pairs including URLs, headers, and body content.

Question 5

What is the forensic significance of the Android 'userdata' partition in an EnCase mobile investigation?

Accepted Answer

It stores user-installed apps, personal data, accounts, and most forensic artifacts

Answer

The userdata partition contains installed applications, user files, databases, credentials, and most evidentiary artifacts critical to mobile forensic investigations.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Mobile Forensics 5