Deck 20: Mobile Device Forensics

Question 1

The Smartphone was developed under which technology?

A)Digital networks
B)Broadband networks
C)Native IP networks
D)Analog networks

Answer 1

B

Question 2

Working on what type of surface increases the danger of static electricity?

A)Metal tables
B)Hardwood floors
C)Carpet
D)Lab desk

Answer 2

C

Question 3

What does 1G consist of?

A)Analog networks
B)Digital networks
C)Broadband networks
D)Native IP networks

Answer 3

A

Question 4

In 2001, mobile Broadband networks (3G)arrived on the scene in what country?

A)North Korea
B)China
C)Japan
D)India

Question 5

What does the ICCID contain?

A)IIN (issuer identification number)
B)UPC (universal purchase code number)
C)PID (phone identification number)
D)IP address

Question 6

What does 3G consist of?

A)Analog networks
B)Digital networks
C)Broadband networks
D)Native IP networks

Question 7

What would an investigator do with the SIM card to retain a perfect copy for evidentiary purposes?

A)Take a picture
B)Upload to a PC
C)Clone the SIM
D)Properly store in evidence

Question 8

What does SIM stand for?

A)Subscriber Identity Module
B)Source Information Memory
C)Simple Identification Mount
D)Subscriber Identification Memory

Question 9

What is another name for a temporal chain of events?

A)Cause and effect
B)A timeline
C)Crime assessment
D)Crime log

Question 10

What feature on a mobile device can help an investigator establish a timeline?

A)GPS
B)NFC
C)Android Beam
D)Bluetooth

Question 11

Mobile devices began as an outgrowth of ship-to-shore radios in World War I.

Question 12

When working on electronic devices, what should you use to dissipate any static charge that might damage electronic chips?

A)Rubber-soled shoes
B)Prevention of physical contact
C)Gloves
D)Grounded anti-static wristband

Question 13

Feature phones have divergent - based upon the phone - feature sets. These core features usually are:

A)Phone and text.
B)E-mail and camera.
C)Applications and media.
D)Both A and B

Question 14

Since the ________, the concepts of handoff and frequency reuse allowed users to move between cells without dropping calls.

A)1960s
B)1970s
C)1980s
D)1990s

Question 15

Because a mobile device is similar a computer and transmits wireless signals, what laws does an investigator need to follow?

A)Radio laws
B)First Amendment rights
C)Computer laws
D)Both A and C

Question 16

What type of network devices started using operating systems?

A)1G
B)2G
C)3G
D)4G

Question 17

What does 2G consist of?

A)Analog networks
B)Digital networks
C)Broadband networks
D)Native IP networks

Question 18

It may not be possible to recover deleted file items from a mobile device, such as:

A)E-mails.
B)Text messages.
C)Photos.
D)All the above

Question 19

What does 4G consist of?

A)Analog networks
B)Digital networks
C)Broadband networks
D)Native IP networks

Question 20

How many types of chains of evidence are there?

A)1
B)2
C)4
D)5

Question 21

2G appeared in the 1990s using two standards: GSM & CDMA.

Question 22

One interesting aspect of mobile device forensics is geolocation. Some devices and many apps report out the geographical location of the device. That can make it much easier to track the owner's movements.

Question 23

Just because an app is written for Apple's iOS operating system does not mean that it runs equally well or behaves the same on the iPad and iPhone.

Question 24

2G and 3G phones are closest in architecture and design to a PC.

Question 25

A digital forensic investigation depends upon timelines for its success. When overlaid on the timelines of a physical crime, the timelines from mobile devices and computers provide an excellent yardstick by which to measure the play of events surrounding the crime itself.

Question 26

Logical extractions are useful only when the physical option is not available because of the device itself.

Question 27

Each SIM card has an international mobile subscriber identity number that associates the phone with the subscriber's mobile network.

Question 28

From a forensic perspective it is a toss-up as to how much data you may be able to extract from a 2G device.

Question 29

Physical extraction is a snapshot of the file system showing what the file system wants you to see.

Question 30

Some tools, such as Cellebrite's UFED Touch, are quite clear about which devices support physical extraction.

Question 31

An integrated circuit identification (ICCID)number is located on each SIM.

Question 32

All mobile devices use SIM cards.

Question 33

By cloning the SIM card, the investigator retains a perfect copy for evidentiary purposes.

Question 34

Blackberry is the only mobile device that can be recovered directly.

Question 35

SD cards and SIM cards perform the same way.

Question 36

Analog phones have divergent feature sets. The core features usually were phone, e-mail, text, and camera.

Question 37

Causal chains of evidence describe the events of a crime in terms of cause and effect.

Question 38

Even though some mobile devices are really small computers with computer-like operating systems, they can usually be examined using typical computer forensic tools.

Question 39

It may not be possible to recover deleted file items from a mobile device such as e-mails, texts, and photos.

Question 40

All mobile devices have architecture.

Question 41

________ forensic images are bit-by-bit copies of the file system, including deleted data.

Question 42

When working with mobile devices, ________ searching is probably the most useful source of information available to the investigator.

Question 43

The amount of information we can get from a mobile device varies greatly with the device in question.

Question 44

When a mobile device is set to use WiFi, it will recognize any WiFi network in its range but may not be able to join the network because of the security settings on the WiFi access point-the mobile device will see it and note that it exists. When that happens, the device takes note of the network and logs it.

Question 45

Tools such as ________ and MPE+ greatly simplify mobile forensic work.

Question 46

You can't use a 1G phone to track a 15-year-old crime.

Question 47

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Architecture

Question 48

________ crime assessment is a technique that can be used when faced with a physical crime (murder, rape, robbery, etc.)and there is a digital element to it-a computer, cell phone, or other mobile device.

Question 49

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
CDMA (Code Division Multiple Access)

Question 50

Each SIM has an international mobile subscriber identity (IMSI)number that associates the phone with the subscriber's mobile ________.

Question 51

________ phones have divergent (based upon the phone)feature sets. The core features are usually phone, e-mail, text, and camera.

Question 52

3G and 4G mobile devices have the ability to download and install ________, the same as a PC or MAC.

Question 53

It often is desirable to ________ the SIM in much the same way one would take a physical image of the mobile device or a computer.

Question 54

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Broadband

Question 55

________ devices were the first to use an operating system.

Question 56

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Analog

Question 57

Since the 1960s, the concepts of handoff and frequency reuse allowed users to move between ________ without dropping a call.

Question 58

In many ways mobile device forensics is similar to ________ forensics.

Question 59

Users of mobile devices need to manually perform various forms of housekeeping from small simple tasks like doing routine checks of address books and contacts to larger tasks such as connecting to local WiFi connections, formatting storage, clearing out device memory, or forcing background programs to close.

Question 60

When ________ was launched in Japan in 2001, moving photos over the network, streaming video and television, video chat, and other advanced services now could be supported.

Question 61

What value can be gleaned from each generation of mobile device (1G, 2G, 3G, and 4G)? What are their strengths and weaknesses?

Question 62

Even though mobile devices are really small computers with computer-like OSs, they usually cannot be examined using typical computer forensic tools. Elaborate on some of the differences between examining a 4G smartphone and a computer.

Question 63

When should an examiner do a physical extraction versus a logical extraction, or both?

Question 64

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Logical extraction

Question 65

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Physical extraction

Question 66

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Operating system

Question 67

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
GSM (Global System for Mobile Communication)

Question 68

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
File system

Question 69

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
SD card

Question 70

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
WiFi

Question 71

Describe the process of using each generation of mobile device to create a timeline and correlate events on the device.

Question 72

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
Geolocation

Question 73

If there is a GPS capability on a smartphone, how might the investigator use it in the investigation?

Question 74

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
SIM card

Question 75

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
SMS (Short Message Service)

Question 76

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once.

A)A cellular network facility that allows users to send and receive text messages
B)A software mechanism that defines the way files are named, stored, organized, and accessed
C)A set of standards for second-generation cellular networks
D)Assessment of the actual geographical location of a mobile device
E)A custom-designed program that controls the components of mobile devices and facilitates how they function.
F)A snapshot of the file system of a mobile device
G)A storage expansion card for a mobile device
H)The traditional method of modulating radio signals so that they can carry information
I)A term describing a wireless Local Area Network
J)A spread-spectrum technology for cellular networks
K)A duplicate of data located on a mobile device
L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information
M)The basic components of a mobile device
N)A communication channel that can provide higher-speed data communication than a standard telephone circuit
O)A system for determining position by comparing radio signals from several satellites
GPS (Global Positioning System)

Question 77

Describe the two different types of chain of evidence and how they can be used in the investigative process.