Which type of data is commonly found in social media app caches on a mobile device?

The user's bank account passwords

The operating system kernel logs

Thumbnails, images, and profile data

You are investigating a phishing email that was sent to multiple employees. The email claims to be from the IT department and asks for passwords. You have the full email header. Which header field would be most useful for identifying the originating IP address of the sender?

The 'Received' field from the last hop before the recipient's mail server.

An investigator is analyzing a video posted on YouTube that allegedly shows a crime. The video was uploaded from a mobile device. The investigator wants to determine the exact location where the video was recorded. Which metadata source would be most reliable?

The video's title and description on YouTube.

The video's embedded EXIF metadata, including GPS coordinates, if present.

The IP address of the uploader, obtained from YouTube's server logs.

The video's file size and resolution.

During a forensic examination of a smartphone, you need to recover social media artifacts from the Instagram app. The phone is an Android device, and the user has also used Instagram in the Chrome browser. Which of the following is the most comprehensive approach to recover relevant artifacts?

Only extract the app's data from the /data/data/com.instagram.android directory.

Only parse Chrome's cache and history because the app data is encrypted and inaccessible.

Use a cloud extraction tool to pull the user's Instagram account data from the server.

Extract the app's data from the /data/data/com.instagram.android directory and also parse Chrome's cache and history.

EC-CouncilComputer Hacking Forensic Investigator

Domain 6Objective 2

Email and Social Media Forensics CHFI Practice Questions (Page 10)

Part of the Cloud and Communication Forensics domain, which makes up ~14% of our current practice bank.

55questions here

11free pages

11concepts

Questions 46–50

46foundation · easy
Which type of data is commonly found in social media app caches on a mobile device?
Select an answer first
47application · medium
You are investigating a phishing email that was sent to multiple employees. The email claims to be from the IT department and asks for passwords. You have the full email header. Which header field would be most useful for identifying the originating IP address of the sender?
Select an answer first
48expert · hard
An investigator is analyzing a video posted on YouTube that allegedly shows a crime. The video was uploaded from a mobile device. The investigator wants to determine the exact location where the video was recorded. Which metadata source would be most reliable?
Select an answer first
49foundation · easy
When analyzing an email header, which field provides the most reliable information about the sending mail server's hostname and IP address?
Select an answer first
50application · medium
During a forensic examination of a smartphone, you need to recover social media artifacts from the Instagram app. The phone is an Android device, and the user has also used Instagram in the Chrome browser. Which of the following is the most comprehensive approach to recover relevant artifacts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.