Final Exam

Question 1

What file system is the Android operating system based on?

Answer 1

Linux

Question 2

What are some important folders common to most Android devices?

Answer 2

Boot.
System.
Recovery.
Data.
Cache.
Misc.

Question 3

Why do forensic examiners not use write blockers for mobile devices?

Answer 3

They prevent commands from being pushed to the device which are needed for successful acquisition of the device

Question 4

Android Debug Bridge

Answer 4

ADB is a command line tools that allows you to communicate with the Android device and control it.

Question 5

What does enabling USB debugging option do?

Answer 5

Enables communication between the device and a

workstation on which the Android SDK is installed.

Question 6

What is rooting?

Answer 6

Gaining access on the device to allow superuser capabilities and provide open access to the Android device.

Question 7

Disadvantages of Rooting

Answer 7

Errors may result in irreparable damage, void warranty, and increased exposure to malware attacks.

Question 8

3 Types of Data Extraction: Android

Answer 8

Manual.
Logical.
Physical.

Question 9

What are the two hardware techniques used to obtain a

physical extraction?

Answer 9

Chip off.

JTAG.

Question 10

Where are preinstalled application stored on Android devices?

Answer 10

/system/appdirectory.

Question 11

What is the definition of data recovery?

Answer 11

The process of retrieving deleted data from a device when it cannot be accessed normally.

Question 12

In an SD card, should the data be acquired through the device or separate from the
device?

Answer 12

Both.

Question 13

What is file carving?

Answer 13

The process of reassembling computer files from fragments in the absence of file system metadata.

Question 14

What can we use to rename an APK file in order to see the contents of the file?

Answer 14

.zip

Question 15

4 Main Tools Used in Acquisition and Analysis of Android Devices

Answer 15

AFLogical.
Cellebrite.
MobileEdit.
Autopsy.

Question 16

Instead of icons for apps, what do Windows phones us?

Answer 16

Tiles.

Question 17

What does Windows Phone use to achieve
least privilege and isolation for its
applications?

Answer 17

Chambers.

Question 18

What is an obstacle examiners face with

Windows Phone forensics?

Answer 18

Physical and logical extractions are not supported.

Question 19

What are the two types of BlackBerry users?

Answer 19

Consumers who buy.

Enterprise users provided with the device by their employers.

Question 20

Where are the third-party apps’ data stored on a Blackberry device?

Answer 20

SD card.

Question 21

What can a BES administrator do that a forensic

examiner must remain aware of?

Answer 21

Reset user passwords and initialize a remote wipe.

Question 22

Why does the support vary for each model of

BlackBerry devices?

Answer 22

BlackBerry file systems vary greatly per model.