GASF Cloud and Network Forensics for Mobile Devices

Question 1

What type of records maintained by mobile carriers contain call metadata including timestamps, duration, and cell tower information?

Accepted Answer

Call Detail Records (CDR)

Answer

Call Detail Records (CDRs) are carrier-maintained logs that include call metadata such as timestamps, duration, originating/terminating numbers, and cell tower information used for billing and law enforcement purposes.

Question 2

Which Apple cloud service stores iOS device backups and can be a critical forensic evidence source for data not present on the physical device?

Accepted Answer

iCloud

Answer

Apple's iCloud service stores iOS device backups, photos, messages, and app data, making it a critical forensic source that may contain evidence deleted from or not extractable from the physical device.

Question 3

What technique is commonly used to intercept and analyze encrypted HTTPS traffic from mobile applications during forensic investigations?

Accepted Answer

SSL/TLS proxy interception via trusted CA certificate installation

Answer

SSL/TLS proxy interception via installing a trusted CA certificate on the device enables man-in-the-middle decryption of HTTPS traffic, which is the standard technique for analyzing encrypted mobile application communications.

Question 4

Which tool is most commonly used by forensic examiners to capture and analyze network packet captures (PCAPs) from mobile devices?

Accepted Answer

Wireshark

Answer

Wireshark is the industry-standard open-source tool for capturing and analyzing network packet captures (PCAPs), allowing examiners to inspect mobile device communications at a granular protocol level.

Question 5

What is the purpose of a CALEA request in the context of mobile forensic investigations?

Accepted Answer

To compel telecommunications carriers to provide lawful intercept capabilities to law enforcement

Answer

CALEA (Communications Assistance for Law Enforcement Act) requires US telecommunications carriers to build lawful intercept capabilities into their systems, enabling law enforcement to obtain call content and metadata through proper legal process.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Cloud and Network Forensics for Mobile Devices