GASF Android Forensics Techniques 2

Question 1

What is Android File-Based Encryption (FBE) and how does it differ from FDE?

Accepted Answer

FBE encrypts individual files with different keys allowing some data access before unlock; FDE encrypts the entire partition with one key

Answer

FBE is hardware-based; FDE is software-based

Answer

FBE encrypts only media files; FDE encrypts system files

Answer

FBE requires a PIN; FDE requires a password

Question 2

Which Android log contains a record of installed, updated, and removed packages that is useful for forensics?

Accepted Answer

/data/system/packages.xml

Answer

/system/etc/packages.list

Answer

/data/app/install.log

Answer

/var/log/android.log

Question 3

What is the purpose of Android's 'logcat' in a forensic investigation?

Accepted Answer

To capture real-time system and application log output

Answer

To decrypt encrypted databases

Answer

To image the device storage

Answer

To extract deleted files

Question 4

Where does Android's SMS/MMS data get stored on most devices?

Accepted Answer

/data/data/com.android.providers.telephony/databases/mmssms.db

Answer

/sdcard/Messages/sms.db

Answer

/system/telephony/messages.db

Answer

/data/sms/messages.sqlite

Question 5

What is 'Rooting' an Android device and why might it be necessary for forensic acquisition?

Accepted Answer

Gaining superuser (root) access; needed to access /data partition files that are otherwise inaccessible

Answer

Enabling developer mode; needed to install forensic apps

Answer

Resetting the device; needed to bypass FRP

Answer

Installing custom firmware; needed to add forensic partitions

Question 6

Which Android forensic artifact records the history of Wi-Fi networks a device has connected to?

Accepted Answer

/data/misc/wifi/WifiConfigStore.xml

Answer

/data/system/wifi_history.db

Answer

/system/etc/wifi/known_networks.txt

Answer

/data/data/com.android.wifi/networks.xml