Mobile Devices and their Components Flashcards

1
Q

What is a Physical Acquisition?

A
  • Allows the retrieval of hidden, deleted, and corrupted data
  • Data is supplied in “raw” form
  • Involves decoding of a Hex Dump
  • May involve removal of memory chips from circuit boards, destroying the device
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Logical Acquisition?

A
  • Logical acquisition and decoding allows the retrieval of a subset of manually accessible data present on the device
  • Typically uses the device API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does IMEI mean? Why is it significant?

A

International Mobile Equipment Identity

  • The “serial number” of the handset
  • Can reveal Make, Model, Date, Origin
  • Intended to be unique, reprogramming is illegal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How would you retrieve the IMEI of a device?

A
  • Typing *#06#
  • May be physically printed on the device
  • May be printed on the original packaging
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

List 5 methods of connecting to a mobile device

A
  • Physical Cable
  • Bluetooth
  • Infra Red
  • JTAG
  • ISP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What Operating Systems are on the market for mobile devices?

A
  • Apple
  • Android
  • Windows
  • Blackberry
  • Low End Propietary
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a SIM/UICC?

A
  • Subscriber Identity Module
  • Universal Integrated Circuit Card
  • Contains user and network data
  • User data can be locked via PIN/PUK
  • May contain limited storage capacity
  • They allow operators to identify a user, and know which services you avail of.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What types of SIM cards are on the market?

A
  • Standard
  • Mini SIM
  • Micro SIM
  • Nano SIM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a File System Acquisition?

A
  • Uses device and OS specific communication protocols
  • Similar to Logical, except copy of the file system is obtained
  • Requires a physical cable to connect to the device
  • Can be achieved using forensic tools and Flasher tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the typical file system format for removable media? (i.e. memory cards)

A

FAT format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the most common type of removable media in mobile devices?

A

Micro SD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What data can be acquired from Logical acquisitions?

A
  • Calls
  • Contacts
  • SMS
  • Apps
  • Location
  • Video / Audio / Photo
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What data can be acquired through File System acquisition?

A
  • Database artefacts
  • Bluetooth pairings
  • Security Codes
  • Previous inserted SIM details
  • Calls
  • Contacts
  • SMS
  • Chat
  • Location
  • Photos / Video / Audio
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What data can be acquired from a Physical acquisition?

A
  • IMEI
  • IMSI
  • ICC-ID
  • Contacts
  • Call Logs
  • SMS / MMS / Emails
  • Photo / Video / Audio
  • Apps
  • Wifi
  • Geodata
  • Accounts
  • Calendars
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many digits long is an IMEI?

A
  • 15 including a check digit
  • if 16 then it indicates
    the software version
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are digits 1- 8 in an IMEI?

A

Type Allocation Code

  • Identifies make, model and country of origin
  • First two digits the Reporting Body Identifier
  • Third through eight digits the Mobile Equipment Model Identifier
17
Q

What are digits 9 - 14 in an IMEI?

A

Serial Number (SNR)

  • Uniquely assigned to that handset
18
Q

What is the fifteenth and final digit of an IMEI?

A

Check Digit

– Used to check the validity of the IMEI
– Calculated by “Luhn” formula (open source)
– For early handsets, this was always zero

19
Q

Other than IMEI, what other identification codes are there?

A

FCC-ID
- Federal Communications Commission Identification
- Found on devices for US market
- The first three or five characters represent the manufacturer known as the grantee code

20
Q

What types of locks can users place on their device?

A
  • Standard digits
  • Biometric (Face/Finger)
  • Pattern locks
21
Q

How may an investigator access a locked device?

A
  • Ask the owner!
  • Manufacturer default
  • Physical extraction
  • Outsource (i.e. Cellebrite)
22
Q

What is remote wiping and why is it a problem for investigators?

A
  • Wiping on the device from another location
  • Available on Windows, Android, Blackberry, iOS
  • Can be issued via Wifi or Mobile Network
  • Can be prevented with a Faraday bag
23
Q

What network technologies (aside from common GSM phones) exist?

A
  • Global Positioning System (GPS)
  • ## Satellite phones (Iridium)
24
Q

How long does a GPS take to orbit?

A

12 hours

25
Q

How does GPS determine a device’s location?

A

Trilateration of at least 3 satellites

26
Q

What is Russia’s equivalent of GPS?

A

GLONASS

27
Q

What is the EU’s equivalent of GPS?

A

Galileo

28
Q

What is China’s equivalent of GPS?

A

Beidou Navigation Satellite System BDS

29
Q

What is India’s equivalent of GPS?

A

(IRNSS) Indian Regional Navigation System

30
Q

What is Japan’s equivalent of GPS?

A

(QZSS) Quasi Zenith Satellite System

31
Q

What are the common external components of a mobile device?

A
  • On/Off switch
  • SIM Port
  • Data/Charger
  • Battery
  • Speaker / Mic
  • Camera
  • Biometric sensor
  • Antennas (Wifi, NFC, Cellular)
  • Display / Keypad
32
Q

What are the common internal components of a mobile device?

A
  • CPU
  • GPU
  • GPS/GLONASS
  • Memory
  • NFC
  • WiFi