GASF Cloud and Network Forensics for Mobile Devices 3

Question 1

What is the forensic significance of network logs associated with Samsung Knox on enterprise Android devices?

Accepted Answer

They log network connections made while the Knox security container is active, isolating enterprise app traffic

Answer

Samsung Knox maintains separate network logs for connections made within its security container, providing forensic insight into enterprise application network activity that is isolated from the main Android environment.

Question 2

Under what US federal statute can law enforcement send a preservation request to a cloud provider to prevent evidence deletion while formal legal process is being obtained?

Accepted Answer

18 U.S.C. § 2703(f) Preservation Request

Answer

Under 18 U.S.C. § 2703(f), law enforcement can send preservation requests requiring cloud providers to preserve subscriber data for 90 days (extendable to 180) while proper legal process such as a warrant is being obtained.

Question 3

What is a 'warrant canary' and why is it relevant to mobile cloud forensic investigations?

Accepted Answer

A public statement that a provider has NOT received a secret government order; its removal signals a secret legal demand has been served

Answer

A warrant canary is a transparency statement indicating a service provider has not received a secret government order; when the canary is removed, it signals that a secret order (such as a National Security Letter) has been served without direct disclosure.

Question 4

When mobile network artifacts indicate Tor traffic from a device under investigation, what is the primary forensic inference?

Accepted Answer

The user was deliberately anonymizing network communications, which is forensically significant as evidence of anti-forensic awareness

Answer

Tor traffic indicators on a mobile device suggest the user was deliberately employing anonymization to obscure the origin and destination of network communications, indicating anti-forensic awareness that is forensically significant.

Question 5

What is the forensic value of analyzing both NetUsage.sqlite and DataUsage.sqlite together on an iOS device?

Accepted Answer

NetUsage tracks per-route network interface usage while DataUsage tracks per-app cellular/Wi-Fi usage, together providing comprehensive network activity reconstruction

Answer

NetUsage.sqlite records network interface-level usage statistics while DataUsage.sqlite records per-application data consumption; analyzing both together provides a comprehensive picture of network activity tied to specific apps and time periods.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Cloud and Network Forensics for Mobile Devices 3