Deck 20: Digital Evidence on Mobile Devices

Question 1

One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.

Answer 1

False

Question 2

The primary reason that brute-force methods are not used when trying to access an SIM card with the PIN set is:

A) A four-digit PIN represents 10,000 possible combinations.
B) After three failed attempts, the SIM card will become locked.
C) PIN disclosure by the offender can be required by a court order.
D) None of the above.

Answer 2

B

Question 3

Software designed to monitor activities on mobile devices has come to be called:

A) Malware
B) Spouseware
C) Trojan defense
D) None of the above

Answer 3

B

Question 4

Powering down a mobile device and removing the battery may cause problems in that:

A) When the battery is removed from a mobile device, the information in memory is lost.
B) Doing so may activate security measures such as lock codes and encryption.
C) The process of removing the battering can cause a capacitive discharge, destroying the device.
D) You now have two pieces of evidence, which have to be documented.

Question 5

A peculiarity of mobile devices is the format that they store SMS messages, which is:

A) ASCII
B) Unicode
C) GSM 7-bit
D) Baudot

Question 6

One of the difficulties unique to forensic processing of mobile devices is:

A) MD five hashes must be calculated for data recovered from mobile devices.
B) Documentation must show continuous possession and control.
C) An investigator must make a calculated decision to either prevent or allow the device to receive new data over wireless networks.
D) Any issues encountered with processing the device should be documented.

Question 7

The reason that malware developers are beginning to target mobile devices is:

A) Because available memory is much smaller and the operating system is much less sophisticated on mobile devices, it is much easier to develop malicious code.
B) The malware market has become very crowded and developers are looking for new avenues.
C) Since the coding is much simpler on mobile devices, many new programmers are trying at this particular platform.
D) Since mobile devices are used more and more for online banking and making purchases, they have become prime targets for computer criminals.

Question 8

Since mobile devices consist of a CPU, memory, storage, and software, the same as traditional computers, they are processed in exactly the same way.

Question 9

One major advantage of mobile devices from a forensic perspective is that:

A) People very seldom delete information from mobile devices.
B) The process for deleting information is much more complicated than for adding information, and users frequently don't delete things correctly.
C) Flash memory is deleted block-by-block and mobile devices generally wait for a block to be full before it is deleted.
D) Manufacturers reserve a part of memory for storing deleted items.

Question 10

Which of the following is NOT one of the methods mobile devices use to communicate?

A) FDDI
B) Telecommunication networks
C) WiFi access points
D) Bluetooth piconets

Question 11

Certain data on mobile devices, in particular phone numbers, are stored in "nibble reversed" format. In that case, the phone number 12025437078 would be displayed as:

A) 2120457370F8
B) 20217345870
C) 87073452021
D) 8F0737542021

Question 12

Mobile devices are considered to be a type of embedded system.

Question 13

The IEEE standard that specifies a standardized interface for testing integrated circuits, interconnections between components, and a means of observing and modifying circuit activity during a component's operation is:

A) RG-45
B) FDDI
C) WiMAX
D) JTAG

Question 14

Forensic examiners should be aware that a mobile device with a blank or broken display:

A) May as well be thrown away, as no data will be recovered from it
B) May only indicate that the screen is damaged and it may still be possible to extract data
C) May require that the mobile device be sent out to the manufacturer for repairs
D) None of the above

Question 15

Given the small amount of usable data obtainable from mobile devices, the forensic investigator needs to weigh the value of investing time examining mobile devices.

Question 16

One of the dangers (from a forensic standpoint) of mobile devices is:

A) Connected networks can contain investigatively useful information.
B) Network service providers may provide information for comparison with data extracted from a mobile device.
C) Connected networks can enable offenders to delete data remotely.
D) Network service providers may provide additional historical call records.

Question 17

Why is it important to collect charging cables when seizing mobile devices?

A) Mobile device batteries have a limited charge life span, and the device will need a charger to maintain the battery until the device can be processed.
B) To reduce owner complaints about missing cables when, at some point, seized devices are returned.
C) In those cases where evidence seized is forfeit, you want to make sure you have everything you need to operate the device.
D) None of the above.

Question 18

Which of the following are methods for preserving mobile devices by isolating them from the networks?

A) Reconfigure the device to prevent communication from the network.
B) Place the device in an RF-shielded pouch.
C) Jam RF signaling in the immediate area.
D) All of the above.

Question 19

Mobile devices have become a promising new target for malware developers.

Question 20

Which of the following is NOT one of the currently available methods for extracting data from mobile devices?

A) Manual operation via user interface
B) Logical acquisition via communication port
C) Connecting the communication port directly to an output device such as a printer
D) Physical acquisition via the communication port

Question 21

Best practices for seizing a mobile device is to power the device off and remove the battery so that no new connections are made over the network.

Question 22

Although mobile devices may connect to networks, WiFi and Bluetooth connections, and desktops synchronizing software, the forensic examiner should focus entirely on the mobile device itself.

Question 23

Certain data on mobile devices, particularly phone numbers, are stored in nibble-reversed format.

Question 24

The forensic examiner's best option for the most complete collection of data from a mobile device is to make a physical acquisition.

Question 25

One of the difficulties in processing mobile devices is that the manufacturers always use proprietary storage formats.

Question 26

Discuss the preservation, examination, and analysis issues that make processing mobile devices unique.

Question 27

The dynamic nature of mobile device communications presents additional challenges for the forensic examiner.

Question 28

Discuss methodologies for processing a crime scene involving mobile devices. Take into account the special issues relating to mobile devices.

Question 29

There are currently no forensic tools available for processing mobile devices.

Question 30

When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.

Question 31

Something forensic examiners need to keep in mind when trying to brute force an SIM card that has had a PIN set is that the card will lock after the second failed attempt.

Question 32

It is often possible to perform a forensic analysis of a physical duplicate of mobile devices using file system forensic tools.