During an investigation, an examiner needs to recover the user's location history from a third-party navigation app on an iPhone. The app stores data in its sandbox. Which method is most appropriate to extract this data?

Access the app's cloud storage via the user's iCloud account.

Use a physical acquisition tool to read the app's sandbox directly.

Use a file system extraction tool that exploits a bootrom vulnerability.

Perform a logical backup and extract the app's data from the backup.

What is the primary goal of mobile forensics?

To identify, preserve, analyze, and present digital evidence from mobile devices in a legally acceptable manner

To recover deleted data from mobile devices

To unlock any mobile device using various techniques

To monitor live communications on a suspect's phone

A forensic examiner is comparing tools for a mobile forensics lab. The lab handles a variety of devices, including both Android and iOS. Which tool feature is most important for the lab's needs?

A user-friendly graphical interface.

Support for both logical and physical acquisition methods.

The ability to generate reports in PDF format.

Why is it important to identify the make and model of a mobile device before acquisition?

To determine the appropriate forensic tools and procedures

To estimate the device's resale value

To determine the owner's identity

A forensic examiner is investigating a case where the suspect used an iPhone with iCloud Backup enabled. The phone is not available, but the examiner has a legal authorization to obtain the iCloud backup. Which approach is most appropriate to acquire the backup?

Perform a logical acquisition of the backup from the suspect's computer.

Use the suspect's Apple ID credentials to download the backup manually.

Use a forensic tool that supports iCloud acquisition, such as Cellebrite UFED Cloud.

Request the backup directly from Apple via a legal process.

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 1

Mobile Forensics CHFI Practice Questions (Page 1)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

13concepts

Questions 1–5

1application · medium
During an investigation, an examiner needs to recover the user's location history from a third-party navigation app on an iPhone. The app stores data in its sandbox. Which method is most appropriate to extract this data?
Select an answer first
2foundation · easy
What is the primary goal of mobile forensics?
Select an answer first
3application · medium
A forensic examiner is comparing tools for a mobile forensics lab. The lab handles a variety of devices, including both Android and iOS. Which tool feature is most important for the lab's needs?
Select an answer first
4foundation · easy
Why is it important to identify the make and model of a mobile device before acquisition?
Select an answer first
5expert · hard
A forensic examiner is investigating a case where the suspect used an iPhone with iCloud Backup enabled. The phone is not available, but the examiner has a legal authorization to obtain the iCloud backup. Which approach is most appropriate to acquire the backup?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.