Deck 20: Mobile Device Forensics

Question 1

It may not be possible to recover deleted file items from a mobile device,such as:

A) E-mails
B) Text messages
C) Photos
D) All the above

Answer 1

D

Question 2

What does 2G consist of?

A) Analog networks
B) Digital networks
C) Broadband networks
D) Native IP networks

Answer 2

B

Question 3

The Smartphone was developed under which technology?

A) Digital networks
B) Broadband networks
C) Native IP networks
D) Analog networks

Answer 3

B

Question 4

How many types of chains of evidence are there?

A) 1
B) 2
C) 4
D) 5

Question 5

What would an investigator do the SIM card to retain a perfect copy for evidentiary purposes?

A) Take a picture
B) Upload to a PC
C) Clone the SIM
D) Properly store in evidence

Question 6

What does 4G consist of?

A) Analog networks
B) Digital networks
C) Broadband networks
D) Native IP networks

Question 7

What does 3G consist of?

A) Analog networks
B) Digital networks
C) Broadband networks
D) Native IP networks

Question 8

Since the ________,the concepts of handoff and frequency reuse allowed users to move between cells without dropping calls.

A) 1960s
B) 1970s
C) 1980s
D) 1990s

Question 9

What does the ICCID contain?

A) IIN (issuer identification number)
B) UPC (universal purchase code number)
C) PID (phone identification number)
D) IP address

Question 10

What is another name for a temporal chain of events?

A) Cause and effect
B) A timeline
C) Crime assessment
D) Crime log

Question 11

What does SIM stand for?

A) Subscriber Identity Module
B) Source Information Memory
C) Simple Identification Mount
D) Subscriber Identification Memory

Question 12

Feature phones have divergent - based upon the phone - feature sets.These core features usually are:

A) Phone and text
B) E-mail and camera
C) Applications and media
D) Both A and B

Question 13

Which is/are the most popular operating system(s)for mobile devices?

A) Apple iOS
B) Google Android
C) Microsoft Windows Phone OS
D) All the above

Question 14

What feature on a mobile device can help an investigator establish a timeline?

A) GPS
B) NFC
C) Android Beam
D) Bluetooth

Question 15

Working on what type of surface increases the danger of static electricity?

A) Metal tables
B) Hardwood floors
C) Carpet
D) Lab desk

Question 16

What type of network devices started using operating systems?

A) 1G
B) 2G
C) 3G
D) 4G

Question 17

What does 1G consist of?

A) Analog networks
B) Digital networks
C) Broadband networks
D) Native IP networks

Question 18

Because a mobile device is similar a computer and transmits wireless signals,what laws does an investigator need to follow?

A) Radio laws
B) First Amendment rights
C) Computer laws
D) Both A and C

Question 19

When working on electronic devices,what should you use to dissipate any static charge that might damage electronic chips?

A) Rubber-soled shoes
B) Prevention of physical contact
C) Gloves
D) Grounded anti-static wristband

Question 20

In 2001,mobile Broadband networks (3G)arrived on the scene in what country?

A) North Korea
B) China
C) Japan
D) India

Question 21

Blackberry is the only mobile device that can be recovered directly.

Question 22

From a forensic perspective it is a toss-up as to how much data you may be able to extract from a 2G device.

Question 23

Even though some mobile devices are really small computers with computer-like operating systems,they can usually be examined using typical computer forensic tools.

Question 24

Each SIM card has an international mobile subscriber identity number that associates the phone with the subscriber's mobile network.

Question 25

2G and 3G phones are closest in architecture and design to a PC.

Question 26

Integrated circuit Identification (ICCID)number is located on each SIM.

Question 27

By cloning the SIM card,the investigator retains a perfect copy for evidentiary purposes.

Question 28

Just because an app is written for Apple's iOS operating system does not mean that it runs equally well or behaves the same on the iPad and iPhone.

Question 29

All mobile devices have architecture.

Question 30

2G appeared in the 1990s using two standards: GSM & CDMA.

Question 31

One interesting aspect of mobile device forensics is geolocation.Some devices and many apps report out the geographical location of the device.That can make it much easier to track the owner's movements.

Question 32

A digital forensic investigation depends upon timelines for its success.When overlaid on the timelines of a physical crime,the timelines from mobile devices and computers provide an excellent yardstick by which to measure the play of events surrounding the crime itself.

Question 33

SD cards and SIM cards perform the same way.

Question 34

Mobile devices began as an outgrowth of ship-to-shore radios in World War I.

Question 35

Analog phones have divergent feature sets.The core features usually were phone,e-mail,text,and camera.

Question 36

Logical extractions are useful only when the physical option is not available because of the device itself.

Question 37

All mobile devices use SIM cards.

Question 38

Causal chains of evidence describe the events of a crime in terms of cause and effect.

Question 39

Physical extraction is a snapshot of the file system showing what the file system wants you to see.

Question 40

It may not be possible to recover deleted file items from a mobile device such as e-mails,texts,and photos.

Question 41

When working with mobile devices,________ searching is probably the most useful source of information available to the investigator.

Question 42

________ crime assessment is a technique that can be used when faced with a physical crime (murder,rape,robbery,etc.)and there is a digital element to it-a computer,cell phone,or other mobile device.

Question 43

When a mobile device is set to use WiFi,it will recognize any WiFi network in its range may not be able to join the network because of the security settings on the WiFi ________ point,but the mobile device will see it and note that it exists.When that happens,the device takes note of the network and logs it.

Question 44

________ phones have divergent (based upon the phone)feature sets.The core features usually were phone,e-mail,text,and camera.

Question 45

When ________ was launched in Japan in 2001,moving photos over the network,streaming video and television,video chat,and other advanced services now could be supported.

Question 46

What value can be gleaned from each generation of mobile device (1G,2G,3G,and 4G)?
What are their strengths and weaknesses?

Question 47

When a mobile device is set to use WiFi,it will recognize any WiFi network in its range but may not be able to join the network because of the security settings on the WiFi access point-the mobile device will see it and note that it exists.When that happens,the device takes note of the network and logs it.

Question 48

Each SIM has an international mobile subscriber identity (IMSI)number that associates the phone with the subscriber's mobile ________.

Question 49

Tools such as ________ and MPE+ greatly simplify mobile forensic work.

Question 50

The amount of information we can get from a mobile device varies greatly with the device in question.

Question 51

3G and 4G mobile devices have the ability to download and install ________,the same as a PC or MAC.

Question 52

Some tools,such as Cellebrite's UFED Touch,are quite clear about which devices support physical extraction.

Question 53

________ forensic images are bit-by-bit copies of the file system,including deleted data.

Question 54

Since the 1960s,the concepts of handoff and frequency reuse allowed users to move between ________ without dropping a call.

Question 55

It often is desirable to ________ the SIM in much the same way one would take a physical image of the mobile device or a computer.

Question 56

You can't use a 1G phone to track a 15-year-old crime.

Question 57

Match the word in Column 1 to its definition in Column 2.Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
1)Analog
2)Architecture
3)Broadband
4)CDMA (Code Division Multiple Access)
5)File system
6)Geolocation
7)GPS (Global Positioning System)
8)GSM (Global System for Mobile Communication)
9)Logical extraction
10)Operating system
11)Physical extraction
12)SIM card
13)SD card
14)SMS (Short Message Service)
15)WiFi

Question 58

Users of mobile devices need to manually perform various forms of housekeeping from small simple tasks like doing routine checks of address books and contacts to larger tasks such as connecting to local WiFi connections,formatting storage,clearing out device memory,or forcing background programs to close.

Question 59

________ devices were the first to use an operating system.

Question 60

In many ways mobile device forensics is similar to ________ forensics.

Question 61

What value can be gleaned from each generation of mobile device (1G,2G,3G,and 4G)?
What are their strengths and weaknesses?

Question 62

Describe the process of using each generation of mobile device to create a timeline and correlate events on the device.

Question 63

Describe the two different types of chain of evidence and how they can be used in the investigative process.

Question 64

When should an examiner do a physical examination versus a logical examination,or both?

Question 65

When should an examiner do a physical examination versus a logical examination,or both?

Question 66

Describe the process of using each generation of mobile device to create a timeline and correlate events on the device.

Question 67

If there is a GPS capability on a smartphone,how might the investigator use it in the investigation?

Question 68

If there is a GPS capability on a smartphone,how might the investigator use it in the investigation?

Question 69

Describe the two different types of chain of evidence and how they can be used in the investigative process.