GASF Cloud and Network Forensics for Mobile Devices 3

Question 1

What is the forensic significance of network logs associated with Samsung Knox on enterprise Android devices?

Accepted Answer

They log network connections made while the Knox security container is active, isolating enterprise app traffic

Answer

They contain hardware encryption keys for storage decryption

Answer

They record all failed MDM enrollment attempts for the device

Answer

They store Wi-Fi enterprise network passwords in plaintext for authentication recovery

Question 2

Under what US federal statute can law enforcement send a preservation request to a cloud provider to prevent evidence deletion while formal legal process is being obtained?

Accepted Answer

18 U.S.C. § 2703(f) Preservation Request

Answer

Evidence Freezing Order under Rule 65

Answer

Rule 3.6 Preservation Hold under Federal Rules

Answer

ECPA Emergency Disclosure under 18 U.S.C. § 2702(b)

Question 3

What is a 'warrant canary' and why is it relevant to mobile cloud forensic investigations?

Accepted Answer

A public statement that a provider has NOT received a secret government order; its removal signals a secret legal demand has been served

Answer

A device-level tool that detects surveillance software installed on mobile devices

Answer

An automated alert system that notifies users whenever their cloud data is accessed by law enforcement

Answer

A network authentication protocol used to validate the legitimacy of law enforcement data requests

Question 4

When mobile network artifacts indicate Tor traffic from a device under investigation, what is the primary forensic inference?

Accepted Answer

The user was deliberately anonymizing network communications, which is forensically significant as evidence of anti-forensic awareness

Answer

The device is infected with a botnet that exclusively uses Tor for command-and-control communication

Answer

The device was connected to a legitimate corporate MDM that uses Tor for secure enterprise tunneling

Answer

The device was using a standard consumer privacy VPN that happens to use Tor-like layered encryption

Question 5

What is the forensic value of analyzing both NetUsage.sqlite and DataUsage.sqlite together on an iOS device?

Accepted Answer

NetUsage tracks per-route network interface usage while DataUsage tracks per-app cellular/Wi-Fi usage, together providing comprehensive network activity reconstruction

Answer

They contain duplicate data that cross-validates the integrity of network evidence

Answer

Both databases store complete browsing history from Safari and installed third-party browsers

Answer

NetUsage stores all incoming data traffic while DataUsage records all outgoing transmissions

Question 6

What does HTTP Strict Transport Security (HSTS) and certificate pinning mean for SSL/TLS interception attempts during mobile network forensic analysis?

Accepted Answer

HSTS and certificate pinning prevent SSL/TLS proxy interception for pinned domains, requiring alternative methods like static app analysis or file system extraction

Answer

HSTS pinning has no practical effect on mobile forensic SSL interception workflows

Answer

HSTS pinning only affects desktop web browsers and does not impact mobile application traffic inspection

Answer

HSTS pinning encrypts the PCAP file itself, making Wireshark-based analysis technically impossible

Question 7

Which Android artifact combination best reveals per-application network access authorization history and background data policy enforcement?

Accepted Answer

/data/system/netpolicy.xml combined with PackageManager permission grants

Answer

/data/system/packages.list combined with app installation timestamps

Answer

/proc/net/tcp and /proc/net/udp runtime socket tables

Answer

/data/misc/dhcp/dhcpcd.log combined with interface assignment records