Test 6 Flashcards
One of the dangers (from a forensic standpoint) of mobile devices is:
Connected networks can contain investigatively useful information.
Network service providers may provide information for comparison with data extracted from a mobile device.
Connected networks can enable offenders to delete data remotely.
Network service providers may provide additional historical call records.
Connected networks can enable offenders to delete data remotely.
One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.
True False
False
Since mobile devices consist of a CPU, memory, storage, and software, the same as traditional computers, they are processed in exactly the same way.
True False
False
One of the difficulties unique to forensic processing of mobile devices is:
MD5 hashes must be calculated for data recovered from mobile devices.
Documentation must show continuous possession and control.
An investigator must make a calculated decision to either prevent or allow the device to receive new data over wireless networks.
Any issues encountered with processing the device should be documented.
An investigator must make a calculated decision to either prevent or allow the device to receive new data over wireless networks.
Who was our Special Presenter on February 20th?
Jeremy
John
Jeffrey
Josh
Jeremy
By default, when Mac OS X boots up, it will attempt to mount an evidence disk.
True False
True
On Mac OS X, when a file is deleted, it is copied to the:
Recycler folder
.Trash folder
[orphans]
None of the above
.Trash folder
The default browser used on Mac OS X is:
Internet Explorer
Safari
Firefox
Opera
Safari
Given the small amount of usable data obtainable from mobile devices, the forensic investigator needs to weigh the value of investing time examining mobile devices.
True False
False
There is a wide selection of forensic tools available for exploiting Macs.
True False
False
Examination of a Mac computer must be done manually – no automated tools exist.
True False
False
The reason that malware developers are beginning to target mobile devices is:
Because available memory is much smaller and the operating system is much less sophisticated on mobile devices, it is much easier to develop malicious code.
The malware market has become very crowded and developers are looking for new avenues.
Since the coding is much simpler on mobile devices, many new programmers are trying at this particular platform.
Since mobile devices are used more and more for online banking and making purchases, they have become prime targets for computer criminals.
Since mobile devices are used more and more for online banking and making purchases, they have become prime targets for computer criminals.
Macintosh disks can only be examined on a Macintosh system.
True False
False
Powering down a mobile device and removing the battery may cause problems in that:
When the battery is removed from a mobile device, the information in memory is lost.
Doing so may activate security measures such as lock codes and encryption.
The process of removing the battering can cause a capacitive discharge, destroying the device.
You now have two pieces of evidence, which have to be documented.
Doing so may activate security measures such as lock codes and encryption.
Where did our Special Presenter from February 20th work?
Target
Best Buy
Medtronic
HelioMetrics
HelioMetrics
