Mobile Forensics CHFI Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A forensic examiner is faced with a high-end Android phone that is locked and encrypted. The examiner has a warrant and needs to extract data. The device is not rooted, and the bootloader is locked. Which acquisition method is most likely to succeed?

   • ALogical acquisition via ADB after unlocking the device.
   • BChip-off acquisition and decryption using the device's key.
   • CFile system extraction using a custom recovery image.
   • DPhysical acquisition using a commercial tool that exploits a bootrom vulnerability.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner is documenting the seizure of a mobile device at a crime scene. The device is powered on and unlocked. Which action should the examiner take to preserve evidence and maintain a proper chain of custody?

   • ARecord the device's IMEI and SIM card number, then place the device in a sealed evidence bag.
   • BPlace the device in airplane mode and document the screen contents with photographs.
   • CDisconnect the device from any network and then perform a logical acquisition on-site.
   • DImmediately power off the device and place it in a Faraday bag.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What information is stored on a SIM card that is useful for forensic investigation?

   • AThe subscriber's phone number and contacts
   • BThe device's GPS location history
   • CThe device's Wi-Fi passwords
   • DThe device's operating system version
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When testifying in court about mobile forensics findings, what should an examiner do?

   • AUse technical jargon to demonstrate expertise
   • BRefuse to answer questions about the tools used
   • CExplain the findings in a clear and understandable manner
   • DOnly state conclusions without explaining the methodology
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic examiner is preparing a report for a court case involving mobile device evidence. The examiner used a physical acquisition method and a commercial tool. What should the report include to ensure admissibility?

   • AA detailed description of the acquisition process, including tool version and hash values.
   • BThe examiner's personal opinion about the suspect's guilt.
   • CThe raw data dump without any analysis.
   • DOnly the final conclusions, without supporting data.
   Reveal Solution Discussion Select an answer first