Test 6 Flashcards
One of the dangers (from a forensic standpoint) of mobile devices is:
Connected networks can contain investigatively useful information.
Network service providers may provide information for comparison with data extracted from a mobile device.
Connected networks can enable offenders to delete data remotely.
Network service providers may provide additional historical call records.
Connected networks can enable offenders to delete data remotely.
One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.
True False
False
Since mobile devices consist of a CPU, memory, storage, and software, the same as traditional computers, they are processed in exactly the same way.
True False
False
One of the difficulties unique to forensic processing of mobile devices is:
MD5 hashes must be calculated for data recovered from mobile devices.
Documentation must show continuous possession and control.
An investigator must make a calculated decision to either prevent or allow the device to receive new data over wireless networks.
Any issues encountered with processing the device should be documented.
An investigator must make a calculated decision to either prevent or allow the device to receive new data over wireless networks.
Who was our Special Presenter on February 20th?
Jeremy
John
Jeffrey
Josh
Jeremy
By default, when Mac OS X boots up, it will attempt to mount an evidence disk.
True False
True
On Mac OS X, when a file is deleted, it is copied to the:
Recycler folder
.Trash folder
[orphans]
None of the above
.Trash folder
The default browser used on Mac OS X is:
Internet Explorer
Safari
Firefox
Opera
Safari
Given the small amount of usable data obtainable from mobile devices, the forensic investigator needs to weigh the value of investing time examining mobile devices.
True False
False
There is a wide selection of forensic tools available for exploiting Macs.
True False
False
Examination of a Mac computer must be done manually – no automated tools exist.
True False
False
The reason that malware developers are beginning to target mobile devices is:
Because available memory is much smaller and the operating system is much less sophisticated on mobile devices, it is much easier to develop malicious code.
The malware market has become very crowded and developers are looking for new avenues.
Since the coding is much simpler on mobile devices, many new programmers are trying at this particular platform.
Since mobile devices are used more and more for online banking and making purchases, they have become prime targets for computer criminals.
Since mobile devices are used more and more for online banking and making purchases, they have become prime targets for computer criminals.
Macintosh disks can only be examined on a Macintosh system.
True False
False
Powering down a mobile device and removing the battery may cause problems in that:
When the battery is removed from a mobile device, the information in memory is lost.
Doing so may activate security measures such as lock codes and encryption.
The process of removing the battering can cause a capacitive discharge, destroying the device.
You now have two pieces of evidence, which have to be documented.
Doing so may activate security measures such as lock codes and encryption.
Where did our Special Presenter from February 20th work?
Target
Best Buy
Medtronic
HelioMetrics
HelioMetrics
Mobile devices are considered to be a type of embedded system.
True False
True
Which of the following is NOT one of the methods mobile devices use to communicate?
FDDI
Telecommunication networks
WiFi access points
Bluetooth piconets
FDDI
Recently accessed files and applications are listed in:
~/Library/Recent
Catalog:Recent
~/Library/Preferences/com.apple.recent.items
com.apple.TextEdit.plist
~/Library/Preferences/com.apple.recent.items
The most common approach to salvaging deleted data on Macintosh systems is to:
Use EnCase to recover the files.
Use the Catalog utility.
Use file carving techniques.
There is currently no solution to recovering deleted files from a Macintosh.
Use file carving techniques.
Due to the design of the Macintosh Catalog file, it is easy to recover deleted files manually, using forensic tools.
True False
False
When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.
True False
True
The folder ~/Library/Mail Downloads contains:
Internet downloads
E-mails that contain attachments
Unread e-mails
E-mail attachments that have been opened
E-mail attachments that have been opened
