Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Mobile Forensics > Midterm Exam > Flashcards

Midterm Exam Flashcards

1
Q

What is Digital Forensics?

A

A branch of forensic science focusing on the recovery and investigation of raw data residing in electronic or digital devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Forensically Sound

A

Original Evidence has not been modified.
Difficult on mobile devices.
Procedures have to be tested, validated, and documented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

3 Main Categories of Mobile Forensics

A

Seizure.
Acquisition.
Examination/Analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Biggest Challenges to Mobile Forensics

A

Data can be accessed, stored, and synchronized across multiple devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Difficulties in Obtaining Mobile Data: Devices

A

Hardware/OS differences.
Generic state of device.
Dynamic nature of devices.
Alteration of data/device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Difficulties in Obtaining Mobile Data: Remote Access

A

Wipes and resets.

Communication shielding.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Difficulties in Obtaining Mobile Data: Resources

A

Lack of resources.
Lack of available tools.
Legal issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Difficulties in Obtaining Mobile Data: Security

A

Security features.
Anti-forensics techniques.
Passcode recovery.
Malicious programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Mobile Evidence Extraction Process: About

A

Extractions of each mobile device may differ.
A consistent examination process should be followed.
There is no well established standard process.
All methods used should be tested, validated, and
documented.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Mobile Evidence Extraction Process: Steps

A 
Intake.
Identification.
Preparation.
Isolation.
Processing.
Verification.
Document and Reporting.
Presentation.
Archive.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Mobile Evidence Extraction Process: Intake

A

Starting phase.
Documents ownership information and the type of
incident the mobile device was involved in.
Outlines the type of data or information needed.
Developing specific objectives for each examination is the critical part of this phase.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Mobile Evidence Extraction Process: Identification

A 
Legal authority.
Goals of the examination.
Make, model, and identifying information of device.
Removable and external data storage.
Other sources of potential evidence.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Mobile Evidence Extraction Process: Preparation

A

Research appropriate methods and tools to be

used on the particular mobile device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Mobile Evidence Extraction Process: Steps: Isolation

A

Isolation before acquisition and examination of the device is important.
Multiple methods of isolation possible.
Some methods are more preferred than others.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Mobile Evidence Extraction Process: Processing

A

The phone should be acquired using a tested method
that is repeatable and as forensically sound as possible.
Physical acquisitions are most preferred.
Least amount of changes to the device.
File system or logical extractions next best methods.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Mobile Evidence Extraction Process: Verification

A

Verify the data in the extraction is accurate by comparing to data on the mobile device:
Comparing extracted data to the handset.
Using multiple tools and comparing results.
Using hash values.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Mobile Evidence Extraction Process: Documents and Reporting

A

Documentation should be done throughout the
examination process.
After examination is complete, peer-review results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Mobile Evidence Extraction Process: Presentation

A

Information extracted and documented should be
able to be clearly presented.
Findings should be clear, concise, and repeatable
Some tools include features that can help explain
findings across multiple devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Mobile Evidence Extraction Process: Archive

A

Preserving extracted data is important.
Retained in a usable format.
Remember court cases can go on for years.
Digital forensics tools are always advancing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

4 Main Types of Operating Systems

A

Google Android.
Apple iOS.
RIM Blackberry.
Windows.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

5 Levels of Mobile Forensics Tools

A 
Manual Extraction.
Logical Analysis.
Hex Dump.
Chip-off.
Micro-Read.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

3 Data Acquisition Methods

A

Manual.
Logical.
Physical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

5 General Rules of Evidence for Digital Evidence

A 
Admissible.
Authentic.
Complete.
Reliable.
Believable.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Leading Operating System for Smart Phones

A

Android.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Easiest Way to Identify iDevice Hardware

A

Observing the model number displayed on the back of the device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the iOS Filed System Built on?

A

HSF Plus.

HSF.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 2 Partitions of the File System? iOS

A

System.

Data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What was the Original iPhone OS Originally Called?

A

Alpine?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What was the Original iPhone OS Originally Called?

A

OS X.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Are all iOS versions supported by all iDevices.

A

No.

31
Q

What is Jailbreaking?

A

Removing limitations by Apple’s mobile operating system through software and hardware exploits.
Biggest reason is for to install unapproved apps.

32
Q

3 Modes iOS Devices are Capable of Running in

A

Normal.
Recovery.
DFU.

33
Q

iOS Recovery Mode

A

If one step in the boot-up process is unable to load
or verify the next step.
Required to perform upgrades or restore the iDevice.

34
Q

iOS Normal Mode

A

The normal mode the phone boots into.

35
Q

iOS Normal Mode

A

When an iDevice is switched on and booted into its operating system.

36
Q

2 Types of Memory in iOS Devices

A

RAM.

NAND flash memory.

37
Q

Custom Ramdisk Method: iOS

A

Gains access to file system by loading a custom
ramdisk into memory and exploiting a weakness
in the boot process while the device is in DFU mode.
Custom ramdisk contains the forensic tools necessary
to dump the file system.
Loading a custom ramdisk does not alter the user
data.
Only works for iPhone 4 and older.

38
Q

Where is the passcode stored since iOS 4?

A

Not on the device in any format.

39
Q

Where is the passcode stored since iOS 4?

A

Not on the device in any format.

Previously stored directly in the keychain.

40
Q

What are the actual iOS files encrypted with?

A 
Actual files on the file system are encrypted with
data protection class keys.
41
Q

What does jailbreaking allow examiners to do? iOS

A

Allows physical acquisitions on devices that are not
vulnerable to the Boot ROM exploit must be jailbroken.
Install tools that would not normally be on the device.
Problem: makes changes to devices that may damage evidence or render it inadmissible in court.
Logical acquisition should be considered first.

42
Q

What was introduced in iOS 6 that prevents examiners from patching the kernal code directly?

A

Kernal Address Space Layout Randomization.

Kernal Address Space Protection.

43
Q

What is a computer that an iDevice is backed up to called?

A

The host computer.

44
Q

Where are the iOS pairing records stored by a Windows computer?

A

/var/root/Library/Lockdown/pair_records/directory.
Pairing records are stored as a plist file with a filename representing the unique identifier given to the computer.
Windows - %AllUserProfile%\Apple\Lockdown.

45
Q

Where are the iOS pairing records stored by a Mac OS X computer?

A

Mac OS X - /private/var/db/lockdown.

46
Q

40-Character Hex String that Corresponds to iOS Backup Files?

A

It matches the UDID of the device.

47
Q

4 Data Files Contained in iOS Backup Directory?

A

info. plist
manifest. plist
status. plist
manifest. mbdb

48
Q

iOS info.plist

A 
This file stores details about the backed up device:
ICCID.
Last backup date.
IMEI.
Phone number.
Installed Apps.
Product type and production version.
Serial number.
iTunes version.
Device’s UDID.
49
Q

iOS manifest.plist

A 
Describes the contents of the backup:
Applications.
Date.
IsEncrypted.
Lockdown.
WasPasscodeSet.
 Backup Keybag
50
Q

iOS manifest.plist

A 
Describes the contents of the backup:
Applications.
Date.
IsEncrypted.
Lockdown.
WasPasscodeSet.
Backup Keybag.
51
Q

iOS status.plist

A

The status.plist file stores details about the backup status:
Backup state.
Date.
IsFullBackup.

52
Q

iOS manifest.mbdb

A

Contains records about all other files in the backup.directory.

53
Q

Is a complete backup created every time a user backs up their iOS device?

A

First backup is a complete backup.

Subsequent backups only files that are modified.

54
Q

Number of File Backup Domain Categories in iOS

A

12.

55
Q

What domain is the Addressbook database in iOS?

A

HomeDomain.

56
Q

What do you need to know in order to extract an iCloud backup?

A

Apple ID and password.

57
Q

2 Timestamps on iPhone?

A

Unix.

MAC.

58
Q

Unix Time on iOS

A

Unix timestamps are the number of seconds that offsets the Unix epoch time starting from January 1, 1970.

59
Q

MAC Time on iOS

A

Mac absolute time is the number of seconds that offsets the Unix epoch time starting from January 1, 2001.

60
Q

SQLite Database File Extensions

A

.db, .sqlitedb, or no extension.

61
Q

Important Database Files in iOS

A 
Addressbook/Addressbook Images.
Call History.
SMS Messages/SMS Spotlight.
Calendar Events.
Emails.
Photos Metadata.
GPS.
Voicemail/Voicemail Directory.
Notes. 
Safari bookmarks/Safari web cache.
Web application cache.
62
Q

Important plist Domain Files in iOS

A

HomeDomain plist files.
RootDomain plist files.
WirelessDomain list files.
SystemPreferences plist files.

63
Q

What information is in the WirelessDoman file?

A

WirelessDomain plist files contain useful information about the SIM card last used in the device.

64
Q

Other important files in iOS?

A 
Cookies.
Keyboard cache.
Photos/wallpaper/snapshots.
Recordings.
Downloaded applications.
65
Q

Can deleted SQLite databases be recovered?

A

Yes,SQLite databases store the deleted records within the database itself.

66
Q

Elcomsoft iOS Forensic Toolkit Features

A

Supported by both MAC OS X and Windows.
Physical and logical extractions.
Password recovery attacks.
Extract device keys to decrypt raw disk image and keychain items.
Logs and records every step of investigation.

67
Q

Elcomsoft iOS Forensic Toolkit Downsides

A

Does not provide options to analyze acquired data or recover the deleted data.
Supports most iOS devices, but some must be jailbroken.
Does not support all iOS devices.

68
Q

Oxygen Features

A

Allows fully automated forensic acquisition and analysis.
Supports a lot of devices.
Can recover deleted data from databases.
Import a backup/image file obtained using a different tool for analysis.
Password recovery from keychain.
Timeline.

69
Q

Oxygen Downsides

A

Windows only.
Does not support physical acquisitions.
Some logicals need to be jailbroken.

70
Q

Cellebrite Features

A

Supports physical, logical, and file system acquisitions.
Extracts device keys required to decrypt raw disk images and keychain items.
Reveals device passwords if possible.
Supports passcode recovery attacks.
Advanced analysis and decoding of extracted application data.

71
Q

Which tools run on Windows?

A

Forensic Toolkit.
Oxygen.
Cellebrite.

72
Q

Which tools run on Mac OS X?

A

Forensic Toolkit.

73
Q

Disadvantages of Open Source Tools

A

They often do not go through rigorous amounts of testing and validation and may miss data that could be manually extracted by the examiner.

Mobile Forensics (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions