Question 1
A forensic examiner receives a locked Android device with full-disk encryption enabled. After
successfully bypassing the lock screen using an UFED extraction method, what remains the
primary limitation for recovering user data from unallocated space?
A) The encryption key was wiped during the bypass process
B) Physical extraction cannot be performed on encrypted devices
C) The unallocated space remains encrypted and inaccessible without the decryption key
D) Only logical extractions work on Android devices with encryption enabled
Answer: C) The unallocated space remains encrypted and inaccessible without the decryption
key
Rationale: Full-disk encryption encrypts the entire user data partition, and even with lock screen
bypass, the unallocated space remains encrypted because the decryption key is typically derived
from the user's passcode and stored in the Secure Enclave or Trusted Execution Environment;
radio firmware data and device metadata remain readable but deleted file fragments in
unallocated space are not recoverable without decryption .
Question 2
When loading a physical extraction from an Android device into Cellebrite Physical Analyzer,
which indicator confirms that the extraction contains raw user data partitions including deleted
files from unallocated space?
A) The extraction file has a .log extension
B) The extraction type is listed as "Physical Extraction" in the case details
C) The file size is less than 100 MB
D) The device model number appears in the extraction summary
Answer: B) The extraction type is listed as "Physical Extraction" in the case details
,Rationale: Physical extractions capture a bit-for-bit copy of the device's memory including
unallocated space where deleted data may reside, unlike logical extractions which only copy
active files and directories; Physical Analyzer identifies this extraction type during case loading,
confirming that deleted data recovery is possible from the acquired image .
Question 3
An examiner is validating forensic findings from a messaging app database. What is the correct
technical distinction between verification and validation in this context?
A) Verification confirms data integrity; validation confirms the tool decodes data correctly
B) Both terms mean the same thing in digital forensics
C) Verification requires third-party review; validation is self-checking
D) Verification only applies to hardware; validation applies to software only
Answer: A) Verification confirms data integrity; validation confirms the tool decodes data
correctly
Rationale: Verification ensures the data has not changed during processing by comparing hash
values, while validation confirms the forensic tool produces accurate results, often by comparing
output against known test data; for example, verifying hash integrity confirms the extraction
hasn't been altered, while validating that Physical Analyzer correctly decodes SMS timestamps
confirms tool accuracy .
Question 4
During analysis of an iOS physical extraction performed in AFU (After First Unlock) state, what
additional data access does AFU status provide compared to BFU (Before First Unlock) status?
A) AFU provides access only to device metadata like serial numbers
B) AFU provides access to the user data partition because the encryption key is in memory
C) AFU prevents any data extraction from occurring
D) AFU only allows logical extraction, not physical extraction
,Answer: B) AFU provides access to the user data partition because the encryption key is in
memory
Rationale: In AFU state, the user has unlocked the device at least once since boot, meaning the
Secure Enclave holds the decryption keys in memory, allowing forensic tools to access the user
data partition; BFU state means the device is powered on but never unlocked, so the user data
partition remains encrypted and inaccessible without the passcode .
Question 5
An examiner opens an SQLite database in Physical Analyzer and notices several rows have a
value of "1" in a column named "is_deleted." What does this indicate about these records?
A) The database file is corrupted and cannot be fully analyzed
B) The rows have been marked for deletion but may still be recoverable
C) The rows contain encrypted content that requires decryption
D) The rows are system metadata with no evidentiary value
Answer: B) The rows have been marked for deletion but may still be recoverable
Rationale: Many applications use flag columns like "is_deleted," "delete_flag," or "deleted" to
mark rows for removal without immediately erasing them from the database file; these flagged
rows remain in the database until space is needed or vacuum operations occur, making them
recoverable through Physical Analyzer's deleted record viewing features .
Question 6
A suspect claims they never used a particular social media application on their seized device.
Where in the Android file system would an examiner find evidence of application installation
and usage data?
A) /sdcard/Download/
B) /system/app/
C) /data/data/com.application.package/databases/
D) /cache/recovery/
, Answer: C) /data/data/com.application.package/databases/
Rationale: Each Android application has a private directory in /data/data/ using its package
name, where it stores databases containing user activity records, messages, contacts,
preferences, and timestamps; this location persists even if the application icon is hidden from the
launcher or the app is uninstalled .
Question 7
When creating a forensic report for legal proceedings, which elements must be included to
establish the report's trustworthiness and reproducibility under Daubert or Frye standards?
A) Only the findings that support the prosecution's case
B) The cost of forensic tools used during examination
C) Examiner qualifications, case number, hash values, examination date, and methodology
description
D) The suspect's complete criminal history and prior convictions
Answer: C) Examiner qualifications, case number, hash values, examination date, and
methodology description
Rationale: Forensic reports require comprehensive documentation including examiner
credentials, chain of custody identifiers, hash verification values, examination dates, and
detailed methodology descriptions to establish trustworthiness, reproducibility, and admissibility
under evidentiary standards; omitting these elements may result in evidence exclusion .
Question 8
Which function does the SQLite Write-Ahead Logging (WAL) file serve in mobile forensic
investigations?
A) The WAL file stores a complete backup of the entire database file
B) The WAL file acts as a transaction log containing recent changes before they are written to the
main database
A forensic examiner receives a locked Android device with full-disk encryption enabled. After
successfully bypassing the lock screen using an UFED extraction method, what remains the
primary limitation for recovering user data from unallocated space?
A) The encryption key was wiped during the bypass process
B) Physical extraction cannot be performed on encrypted devices
C) The unallocated space remains encrypted and inaccessible without the decryption key
D) Only logical extractions work on Android devices with encryption enabled
Answer: C) The unallocated space remains encrypted and inaccessible without the decryption
key
Rationale: Full-disk encryption encrypts the entire user data partition, and even with lock screen
bypass, the unallocated space remains encrypted because the decryption key is typically derived
from the user's passcode and stored in the Secure Enclave or Trusted Execution Environment;
radio firmware data and device metadata remain readable but deleted file fragments in
unallocated space are not recoverable without decryption .
Question 2
When loading a physical extraction from an Android device into Cellebrite Physical Analyzer,
which indicator confirms that the extraction contains raw user data partitions including deleted
files from unallocated space?
A) The extraction file has a .log extension
B) The extraction type is listed as "Physical Extraction" in the case details
C) The file size is less than 100 MB
D) The device model number appears in the extraction summary
Answer: B) The extraction type is listed as "Physical Extraction" in the case details
,Rationale: Physical extractions capture a bit-for-bit copy of the device's memory including
unallocated space where deleted data may reside, unlike logical extractions which only copy
active files and directories; Physical Analyzer identifies this extraction type during case loading,
confirming that deleted data recovery is possible from the acquired image .
Question 3
An examiner is validating forensic findings from a messaging app database. What is the correct
technical distinction between verification and validation in this context?
A) Verification confirms data integrity; validation confirms the tool decodes data correctly
B) Both terms mean the same thing in digital forensics
C) Verification requires third-party review; validation is self-checking
D) Verification only applies to hardware; validation applies to software only
Answer: A) Verification confirms data integrity; validation confirms the tool decodes data
correctly
Rationale: Verification ensures the data has not changed during processing by comparing hash
values, while validation confirms the forensic tool produces accurate results, often by comparing
output against known test data; for example, verifying hash integrity confirms the extraction
hasn't been altered, while validating that Physical Analyzer correctly decodes SMS timestamps
confirms tool accuracy .
Question 4
During analysis of an iOS physical extraction performed in AFU (After First Unlock) state, what
additional data access does AFU status provide compared to BFU (Before First Unlock) status?
A) AFU provides access only to device metadata like serial numbers
B) AFU provides access to the user data partition because the encryption key is in memory
C) AFU prevents any data extraction from occurring
D) AFU only allows logical extraction, not physical extraction
,Answer: B) AFU provides access to the user data partition because the encryption key is in
memory
Rationale: In AFU state, the user has unlocked the device at least once since boot, meaning the
Secure Enclave holds the decryption keys in memory, allowing forensic tools to access the user
data partition; BFU state means the device is powered on but never unlocked, so the user data
partition remains encrypted and inaccessible without the passcode .
Question 5
An examiner opens an SQLite database in Physical Analyzer and notices several rows have a
value of "1" in a column named "is_deleted." What does this indicate about these records?
A) The database file is corrupted and cannot be fully analyzed
B) The rows have been marked for deletion but may still be recoverable
C) The rows contain encrypted content that requires decryption
D) The rows are system metadata with no evidentiary value
Answer: B) The rows have been marked for deletion but may still be recoverable
Rationale: Many applications use flag columns like "is_deleted," "delete_flag," or "deleted" to
mark rows for removal without immediately erasing them from the database file; these flagged
rows remain in the database until space is needed or vacuum operations occur, making them
recoverable through Physical Analyzer's deleted record viewing features .
Question 6
A suspect claims they never used a particular social media application on their seized device.
Where in the Android file system would an examiner find evidence of application installation
and usage data?
A) /sdcard/Download/
B) /system/app/
C) /data/data/com.application.package/databases/
D) /cache/recovery/
, Answer: C) /data/data/com.application.package/databases/
Rationale: Each Android application has a private directory in /data/data/ using its package
name, where it stores databases containing user activity records, messages, contacts,
preferences, and timestamps; this location persists even if the application icon is hidden from the
launcher or the app is uninstalled .
Question 7
When creating a forensic report for legal proceedings, which elements must be included to
establish the report's trustworthiness and reproducibility under Daubert or Frye standards?
A) Only the findings that support the prosecution's case
B) The cost of forensic tools used during examination
C) Examiner qualifications, case number, hash values, examination date, and methodology
description
D) The suspect's complete criminal history and prior convictions
Answer: C) Examiner qualifications, case number, hash values, examination date, and
methodology description
Rationale: Forensic reports require comprehensive documentation including examiner
credentials, chain of custody identifiers, hash verification values, examination dates, and
detailed methodology descriptions to establish trustworthiness, reproducibility, and admissibility
under evidentiary standards; omitting these elements may result in evidence exclusion .
Question 8
Which function does the SQLite Write-Ahead Logging (WAL) file serve in mobile forensic
investigations?
A) The WAL file stores a complete backup of the entire database file
B) The WAL file acts as a transaction log containing recent changes before they are written to the
main database
