Question 1

The forensic examiner's best option for the most complete collection of data from a mobile device is to make a physical acquisition.

Accepted Answer

A) True 
 B)False  True

Question 2

Forensic examiners should be aware that a mobile device with a blank or broken display:

Accepted Answer

A)  May as well be thrown away, as no data will be recovered from it 
B)  May only indicate that the screen is damaged and it may still be possible to extract data 
C)  May require that the mobile device be sent out to the manufacturer for repairs 
D)  None of the above 
A)  May as well be thrown away, as no data will be recovered from it 
B)  May only indicate that the screen is damaged and it may still be possible to extract data 
C)  May require that the mobile device be sent out to the manufacturer for repairs 
D)  None of the above B

Question 3

Discuss methodologies for processing a crime scene involving mobile devices. Take into account the special issues relating to mobile devices.

Accepted Answer

search for media and SIM cards, seizing related peripherals and communication cables, charging stands, etc., how to isolate the device from the network(s), powering off issues.

Question 4

One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.

Accepted Answer

A) True 
 B)False

Question 5

One of the difficulties in processing mobile devices is that the manufacturers always use proprietary storage formats.

Accepted Answer

A) True 
 B)False

Question 6

Why is it important to collect charging cables when seizing mobile devices?

Accepted Answer

A)  Mobile device batteries have a limited charge life span, and the device will need a charger to maintain the battery until the device can be processed. 
B)  To reduce owner complaints about missing cables when, at some point, seized devices are returned. 
C)  In those cases where evidence seized is forfeit, you want to make sure you have everything you need to operate the device. 
D)  None of the above. 
A)  Mobile device batteries have a limited charge life span, and the device will need a charger to maintain the battery until the device can be processed. 
B)  To reduce owner complaints about missing cables when, at some point, seized devices are returned. 
C)  In those cases where evidence seized is forfeit, you want to make sure you have everything you need to operate the device. 
D)  None of the above.

Question 7

Which of the following is NOT one of the methods mobile devices use to communicate?

Accepted Answer

A)  FDDI 
B)  Telecommunication networks 
C)  WiFi access points 
D)  Bluetooth piconets 
A)  FDDI 
B)  Telecommunication networks 
C)  WiFi access points 
D)  Bluetooth piconets

Question 8

Which of the following are methods for preserving mobile devices by isolating them from the networks?

Accepted Answer

A)  Reconfigure the device to prevent communication from the network. 
B)  Place the device in an RF-shielded pouch. 
C)  Jam RF signaling in the immediate area. 
D)  All of the above. 
A)  Reconfigure the device to prevent communication from the network. 
B)  Place the device in an RF-shielded pouch. 
C)  Jam RF signaling in the immediate area. 
D)  All of the above.

Question 9

When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.

Accepted Answer

A) True 
 B)False

Question 10

Mobile devices have become a promising new target for malware developers.

Accepted Answer

A) True 
 B)False

Question 11

Best practices for seizing a mobile device is to power the device off and remove the battery so that no new connections are made over the network.

Accepted Answer

A) True 
 B)False

Question 12

There are currently no forensic tools available for processing mobile devices.

Accepted Answer

A) True 
 B)False

Question 13

Although mobile devices may connect to networks, WiFi and Bluetooth connections, and desktops synchronizing software, the forensic examiner should focus entirely on the mobile device itself.

Accepted Answer

A) True 
 B)False

Question 14

Certain data on mobile devices, particularly phone numbers, are stored in nibble-reversed format.

Accepted Answer

A) True 
 B)False

Question 15

Something forensic examiners need to keep in mind when trying to brute force an SIM card that has had a PIN set is that the card will lock after the second failed attempt.

Accepted Answer

A) True 
 B)False

Question 16

One major advantage of mobile devices from a forensic perspective is that:

Accepted Answer

A)  People very seldom delete information from mobile devices. 
B)  The process for deleting information is much more complicated than for adding information, and users frequently don't delete things correctly. 
C)  Flash memory is deleted block-by-block and mobile devices generally wait for a block to be full before it is deleted. 
D)  Manufacturers reserve a part of memory for storing deleted items. 
A)  People very seldom delete information from mobile devices. 
B)  The process for deleting information is much more complicated than for adding information, and users frequently don't delete things correctly. 
C)  Flash memory is deleted block-by-block and mobile devices generally wait for a block to be full before it is deleted. 
D)  Manufacturers reserve a part of memory for storing deleted items.

Question 17

Certain data on mobile devices, in particular phone numbers, are stored in "nibble reversed" format. In that case, the phone number 12025437078 would be displayed as:

Accepted Answer

A)  2120457370F8 
B)  20217345870 
C)  87073452021 
D)  8F0737542021 
A)  2120457370F8 
B)  20217345870 
C)  87073452021 
D)  8F0737542021

Question 18

The primary reason that brute-force methods are not used when trying to access an SIM card with the PIN set is:

Accepted Answer

A)  A four-digit PIN represents 10,000 possible combinations. 
B)  After three failed attempts, the SIM card will become locked. 
C)  PIN disclosure by the offender can be required by a court order. 
D)  None of the above. 
A)  A four-digit PIN represents 10,000 possible combinations. 
B)  After three failed attempts, the SIM card will become locked. 
C)  PIN disclosure by the offender can be required by a court order. 
D)  None of the above.

Question 19

Mobile devices are considered to be a type of embedded system.

Accepted Answer

A) True 
 B)False

Question 20

One of the dangers (from a forensic standpoint) of mobile devices is:

Accepted Answer

A)  Connected networks can contain investigatively useful information. 
B)  Network service providers may provide information for comparison with data extracted from a mobile device. 
C)  Connected networks can enable offenders to delete data remotely. 
D)  Network service providers may provide additional historical call records. 
A)  Connected networks can contain investigatively useful information. 
B)  Network service providers may provide information for comparison with data extracted from a mobile device. 
C)  Connected networks can enable offenders to delete data remotely. 
D)  Network service providers may provide additional historical call records.

Exam 20: Digital Evidence on Mobile Devices

The forensic examiner's best option for the most complete collection of data from a mobile device is to make a physical acquisition.

Forensic examiners should be aware that a mobile device with a blank or broken display:

Discuss methodologies for processing a crime scene involving mobile devices. Take into account the special issues relating to mobile devices.

One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.

One of the difficulties in processing mobile devices is that the manufacturers always use proprietary storage formats.

Why is it important to collect charging cables when seizing mobile devices?

Which of the following is NOT one of the methods mobile devices use to communicate?

Which of the following are methods for preserving mobile devices by isolating them from the networks?

When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.

Mobile devices have become a promising new target for malware developers.

Best practices for seizing a mobile device is to power the device off and remove the battery so that no new connections are made over the network.

There are currently no forensic tools available for processing mobile devices.

Although mobile devices may connect to networks, WiFi and Bluetooth connections, and desktops synchronizing software, the forensic examiner should focus entirely on the mobile device itself.

Certain data on mobile devices, particularly phone numbers, are stored in nibble-reversed format.

Something forensic examiners need to keep in mind when trying to brute force an SIM card that has had a PIN set is that the card will lock after the second failed attempt.

One major advantage of mobile devices from a forensic perspective is that:

Certain data on mobile devices, in particular phone numbers, are stored in "nibble reversed" format. In that case, the phone number 12025437078 would be displayed as:

The primary reason that brute-force methods are not used when trying to access an SIM card with the PIN set is:

Mobile devices are considered to be a type of embedded system.

One of the dangers (from a forensic standpoint) of mobile devices is:

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Computer Basics for Digital Investigators

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters