GASF Cloud and Network Forensics for Mobile Devices

Question 1

What type of records maintained by mobile carriers contain call metadata including timestamps, duration, and cell tower information?

Accepted Answer

Call Detail Records (CDR)

Answer

IMSI records

Answer

Network Access Records (NAR)

Answer

Subscriber Identity Records (SIR)

Question 2

Which Apple cloud service stores iOS device backups and can be a critical forensic evidence source for data not present on the physical device?

Accepted Answer

iCloud

Answer

Google Drive

Answer

Dropbox

Answer

OneDrive

Question 3

What technique is commonly used to intercept and analyze encrypted HTTPS traffic from mobile applications during forensic investigations?

Accepted Answer

SSL/TLS proxy interception via trusted CA certificate installation

Answer

SSH tunneling through the device

Answer

IPSec VPN gateway inspection

Answer

RADIUS authentication log analysis

Question 4

Which tool is most commonly used by forensic examiners to capture and analyze network packet captures (PCAPs) from mobile devices?

Accepted Answer

Wireshark

Answer

FTK Imager

Answer

Cellebrite UFED

Answer

Oxygen Forensic Detective

Question 5

What is the purpose of a CALEA request in the context of mobile forensic investigations?

Accepted Answer

To compel telecommunications carriers to provide lawful intercept capabilities to law enforcement

Answer

To obtain device encryption keys from the device manufacturer

Answer

To request physical device access assistance from law enforcement agencies

Answer

To access cloud storage accounts through administrative backdoors

Question 6

Which artifact type from mobile network infrastructure can help establish a device's approximate physical location at a specific point in time?

Accepted Answer

Cell tower connection records with MLAT analysis

Answer

DNS query logs from the device

Answer

HTTP cookie header logs

Answer

Bluetooth device scan logs

Question 7

What iOS forensic artifact stores Wi-Fi network connection history including SSIDs and connection timestamps that can establish location history?

Accepted Answer

/private/var/preferences/SystemConfiguration/com.apple.wifi.plist

Answer

/Library/Preferences/SystemConfiguration/com.apple.network.identification.plist

Answer

/var/mobile/Library/Logs/CrashReporter/wifi_history.db

Answer

/private/var/db/wifi_networks.sqlite