An examiner is investigating a suspect's iPhone and discovers that the suspect used iCloud Backup. The examiner has a legal warrant for the iCloud account. Which acquisition method is most appropriate to obtain the cloud backup data?

Request the iCloud backup from Apple with the warrant

Use the suspect's iCloud credentials to download the backup

Perform a physical acquisition of the iPhone's flash memory

Perform a logical acquisition of the iPhone and rely on local data

A forensic examiner is investigating a case where the suspect used an Android phone with Google account sync enabled. The phone is damaged and cannot be powered on. Which source should the examiner prioritize to recover the suspect's data?

The phone's external SD card, if present.

The Google account's cloud backups and synced data, obtained via a legal request.

The phone's internal memory, which can be read via chip-off.

The phone's SIM card, which may contain call logs.

Which of the following is a method to identify the operating system of a mobile device?

Checking the device's settings menu

An examiner is analyzing a third-party messaging app on an Android device. Where is the app's user data most likely stored?

/data/data/com.example.messaging/

/sdcard/Android/data/com.example.messaging/

/system/app/com.example.messaging/

An examiner needs to recover deleted text messages from a SIM card. The SIM card has been used in a phone for several months. Which statement about SIM card forensics is accurate?

SIM cards store the full content of multimedia messages (MMS).

SIM cards store call records for all calls made by the user.

SIM cards can store deleted text messages in unallocated space.

SIM cards store all text messages sent and received by the user.

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 1

Mobile Forensics CHFI Practice Questions (Page 7)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

13concepts

Questions 31–35

31application · medium
An examiner is investigating a suspect's iPhone and discovers that the suspect used iCloud Backup. The examiner has a legal warrant for the iCloud account. Which acquisition method is most appropriate to obtain the cloud backup data?
Select an answer first
32application · medium
A forensic examiner is investigating a case where the suspect used an Android phone with Google account sync enabled. The phone is damaged and cannot be powered on. Which source should the examiner prioritize to recover the suspect's data?
Select an answer first
33foundation · easy
Which of the following is a method to identify the operating system of a mobile device?
Select an answer first
34application · medium
An examiner is analyzing a third-party messaging app on an Android device. Where is the app's user data most likely stored?
Select an answer first
35application · medium
An examiner needs to recover deleted text messages from a SIM card. The SIM card has been used in a phone for several months. Which statement about SIM card forensics is accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.