SANS 4 585 SMART PHONE FORENSIC ANALYSIS
/QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) ALREADY GRADED A+
Under which iOS sub-directory folder would an examiner expect to find
Internet history, caches, keyboards, and Cookies? Ans✓✓✓Library
The /private/var/mobile/Library folder (physical acquisition), Backup
Service/mobile/Library (File System acquisition) or Library folder
(Logical acquisition) contains most of the data of interest for forensic
examiners. The Library folder contains a vast amount of folders
including those containing data pertaining to communication, Internet
history, Preferences, Keyboard, Caches and more. Tools like Physical
Analyzer provide access to all of these folders and database files.
Another location for the Library folder may be the
Data/Data/mobile/Library for physical acquisition.
Answer Options:
•Health
•Library
•Applications
•Media
What SQLite data type can be exported in order to be opened with a
compatible program? Ans✓✓✓BLOB
,Like the name suggests, BLOBs are comprised of binary data.
Embedded files are stored as BLOBs. This data can be exported and then
opened with a compatible program.
Answer Options:
•PLIST
•TIFE
•BLOB
•JPEG
What can be concluded from a folder named
"00e456d65498137b76ec5b4137a70821df4afdbf"
found in a device's MobileSync directory? Ans✓✓✓The backup was
made prior to fall 2018
The backup files from an iOS device prior to September 2018 changed
from the 40 digit alphanumeric GUID to a format of 8 characters for the
ChipID padded with zeros followed by 16 characters of ECID in hex
padded with zeros on the left. Similar to [Opadding] CHIP-
[0padding]ECID. An iPhone XS/XR series phone will have the Chip ID
of 8020 and an iPhone 11 will have a ChipID of 8030.
Answer Options:
, • The folder was created using Samsung Kies
• The device model is an iPhone 11
• The backup was for an Android phone
• The backup was made prior to fall 2018
What is often more of a challenge with mobile forensics than other areas
of forensics? Ans✓✓✓Isolation of devices
The process of digital forensics is the same as other forensics sciences,
and the process in mobile device forensics closely follows the same
path. In mobile device forensics, however, we also have the extra
challenge of isolation of devices we are working with because they are
designed to communicate with the surrounding mobile network, with
satellites, surrounding wireless networks, and via Bluetooth or other
means.
Answer Options:
• Identification of evidence
• Evidence collection
• Isolation of devices
• Analysis and Reporting of Information
Which feature of Gatekeeper password storage on an Android device
combats the use of rainbow tables to crack the device's PIN or lock
pattern? Ans✓✓✓TEE
/QUESTIONS AND CORRECT DETAILED ANSWERS
(VERIFIED ANSWERS) ALREADY GRADED A+
Under which iOS sub-directory folder would an examiner expect to find
Internet history, caches, keyboards, and Cookies? Ans✓✓✓Library
The /private/var/mobile/Library folder (physical acquisition), Backup
Service/mobile/Library (File System acquisition) or Library folder
(Logical acquisition) contains most of the data of interest for forensic
examiners. The Library folder contains a vast amount of folders
including those containing data pertaining to communication, Internet
history, Preferences, Keyboard, Caches and more. Tools like Physical
Analyzer provide access to all of these folders and database files.
Another location for the Library folder may be the
Data/Data/mobile/Library for physical acquisition.
Answer Options:
•Health
•Library
•Applications
•Media
What SQLite data type can be exported in order to be opened with a
compatible program? Ans✓✓✓BLOB
,Like the name suggests, BLOBs are comprised of binary data.
Embedded files are stored as BLOBs. This data can be exported and then
opened with a compatible program.
Answer Options:
•PLIST
•TIFE
•BLOB
•JPEG
What can be concluded from a folder named
"00e456d65498137b76ec5b4137a70821df4afdbf"
found in a device's MobileSync directory? Ans✓✓✓The backup was
made prior to fall 2018
The backup files from an iOS device prior to September 2018 changed
from the 40 digit alphanumeric GUID to a format of 8 characters for the
ChipID padded with zeros followed by 16 characters of ECID in hex
padded with zeros on the left. Similar to [Opadding] CHIP-
[0padding]ECID. An iPhone XS/XR series phone will have the Chip ID
of 8020 and an iPhone 11 will have a ChipID of 8030.
Answer Options:
, • The folder was created using Samsung Kies
• The device model is an iPhone 11
• The backup was for an Android phone
• The backup was made prior to fall 2018
What is often more of a challenge with mobile forensics than other areas
of forensics? Ans✓✓✓Isolation of devices
The process of digital forensics is the same as other forensics sciences,
and the process in mobile device forensics closely follows the same
path. In mobile device forensics, however, we also have the extra
challenge of isolation of devices we are working with because they are
designed to communicate with the surrounding mobile network, with
satellites, surrounding wireless networks, and via Bluetooth or other
means.
Answer Options:
• Identification of evidence
• Evidence collection
• Isolation of devices
• Analysis and Reporting of Information
Which feature of Gatekeeper password storage on an Android device
combats the use of rainbow tables to crack the device's PIN or lock
pattern? Ans✓✓✓TEE
