Question 1

Which of the following are methods for preserving mobile devices by isolating them from the networks?

Accepted Answer

A)   Reconfigure the device to prevent communication from the network.
B)   Place the device in an RF-shielded pouch.
C)   Jam RF signaling in the immediate area.
D)   All of the above.E) A) and D)
F) None of the above

Question 2

Mobile devices are considered to be a type of embedded system.

Accepted Answer

A) True 
 B)False

Question 3

Something forensic examiners need to keep in mind when trying to brute force an SIM card that has had a PIN set is that the card will lock after the second failed attempt.

Accepted Answer

A) True 
 B)False

Question 4

One of the dangers (from a forensic standpoint)  of mobile devices is:

Accepted Answer

A)   Connected networks can contain investigatively useful information.
B)   Network service providers may provide information for comparison with data extracted from a mobile device.
C)   Connected networks can enable offenders to delete data remotely.
D)   Network service providers may provide additional historical call records.E) All of the above
F) C) and D)

Question 5

One major advantage of mobile devices from a forensic perspective is that:

Accepted Answer

A)   People very seldom delete information from mobile devices.
B)   The process for deleting information is much more complicated than for adding information, and users frequently don't delete things correctly.
C)   Flash memory is deleted block-by-block and mobile devices generally wait for a block to be full before it is deleted.
D)   Manufacturers reserve a part of memory for storing deleted items.E) A) and B)
F) A) and C)

Question 6

Although mobile devices may connect to networks, WiFi and Bluetooth connections, and desktops synchronizing software, the forensic examiner should focus entirely on the mobile device itself.

Accepted Answer

A) True 
 B)False

Question 7

Forensic examiners should be aware that a mobile device with a blank or broken display:

Accepted Answer

A)   May as well be thrown away, as no data will be recovered from it
B)   May only indicate that the screen is damaged and it may still be possible to extract data
C)   May require that the mobile device be sent out to the manufacturer for repairs
D)   None of the aboveE) A) and C)
F) B) and D) B

Question 8

One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.

Accepted Answer

A) True 
 B)False

Question 9

The primary reason that brute-force methods are not used when trying to access an SIM card with the PIN set is:

Accepted Answer

A)   A four-digit PIN represents 10,000 possible combinations.
B)   After three failed attempts, the SIM card will become locked.
C)   PIN disclosure by the offender can be required by a court order.
D)   None of the above.E) B) and D)
F) A) and D)

Question 10

When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.

Accepted Answer

A) True 
 B)False

Question 11

Why is it important to collect charging cables when seizing mobile devices?

Accepted Answer

A)   Mobile device batteries have a limited charge life span, and the device will need a charger to maintain the battery until the device can be processed.
B)   To reduce owner complaints about missing cables when, at some point, seized devices are returned.
C)   In those cases where evidence seized is forfeit, you want to make sure you have everything you need to operate the device.
D)   None of the above.E) A) and B)
F) A) and D)

Question 12

One of the difficulties in processing mobile devices is that the manufacturers always use proprietary storage formats.

Accepted Answer

A) True 
 B)False

Question 13

The forensic examiner's best option for the most complete collection of data from a mobile device is to make a physical acquisition.

Accepted Answer

A) True 
 B)False  True

Question 14

Best practices for seizing a mobile device is to power the device off and remove the battery so that no new connections are made over the network.

Accepted Answer

A) True 
 B)False

Question 15

Which of the following is NOT one of the methods mobile devices use to communicate?

Accepted Answer

A)   FDDI
B)   Telecommunication networks
C)   WiFi access points
D)   Bluetooth piconetsE) C) and D)
F) A) and D)

Question 16

Mobile devices have become a promising new target for malware developers.

Accepted Answer

A) True 
 B)False

Question 17

Certain data on mobile devices, in particular phone numbers, are stored in "nibble reversed" format. In that case, the phone number 12025437078 would be displayed as:

Accepted Answer

A)   2120457370F8
B)   20217345870
C)   87073452021
D)   8F0737542021E) A) and D)
F) None of the above

Question 18

Discuss methodologies for processing a crime scene involving mobile devices. Take into account the special issues relating to mobile devices.

Accepted Answer

search for media and SIM cards, seizing related peripherals and communication cables, charging stands, etc., how to isolate the device from the network(s), powering off issues.

Question 19

Certain data on mobile devices, particularly phone numbers, are stored in nibble-reversed format.

Accepted Answer

A) True 
 B)False

Question 20

There are currently no forensic tools available for processing mobile devices.

Accepted Answer

A) True 
 B)False

Exam 20: Digital Evidence on Mobile Devices

Which of the following are methods for preserving mobile devices by isolating them from the networks?

Correct AnswerverifiedShow Answer

Mobile devices are considered to be a type of embedded system.

Correct AnswerverifiedShow Answer

Something forensic examiners need to keep in mind when trying to brute force an SIM card that has had a PIN set is that the card will lock after the second failed attempt.

Correct AnswerverifiedShow Answer

One of the dangers (from a forensic standpoint) of mobile devices is:

Correct AnswerverifiedShow Answer

One major advantage of mobile devices from a forensic perspective is that:

Correct AnswerverifiedShow Answer

Although mobile devices may connect to networks, WiFi and Bluetooth connections, and desktops synchronizing software, the forensic examiner should focus entirely on the mobile device itself.

Correct AnswerverifiedShow Answer

Forensic examiners should be aware that a mobile device with a blank or broken display:

Correct AnswerverifiedB

One drawback of mobile device examination is that when a user deletes data on a mobile device that data is never recoverable.

Correct AnswerverifiedShow Answer

The primary reason that brute-force methods are not used when trying to access an SIM card with the PIN set is:

Correct AnswerverifiedShow Answer

When analyzing a GPS-enabled mobile device, it is often possible to recover location information, import it into mapping software, and display the locations on a map.

Correct AnswerverifiedShow Answer

Why is it important to collect charging cables when seizing mobile devices?

Correct AnswerverifiedShow Answer

One of the difficulties in processing mobile devices is that the manufacturers always use proprietary storage formats.

Correct AnswerverifiedShow Answer

The forensic examiner's best option for the most complete collection of data from a mobile device is to make a physical acquisition.

Correct AnswerverifiedTrue

Best practices for seizing a mobile device is to power the device off and remove the battery so that no new connections are made over the network.

Correct AnswerverifiedShow Answer

Which of the following is NOT one of the methods mobile devices use to communicate?

Correct AnswerverifiedShow Answer

Mobile devices have become a promising new target for malware developers.

Correct AnswerverifiedShow Answer

Certain data on mobile devices, in particular phone numbers, are stored in "nibble reversed" format. In that case, the phone number 12025437078 would be displayed as:

Correct AnswerverifiedShow Answer

Discuss methodologies for processing a crime scene involving mobile devices. Take into account the special issues relating to mobile devices.

Correct Answerverifiedsearch for media and SIM cards, seizing related peripherals and communication cables, charging stands, etc., how to isolate the device from the network(s), powering off issues.

Certain data on mobile devices, particularly phone numbers, are stored in nibble-reversed format.

Correct AnswerverifiedShow Answer

There are currently no forensic tools available for processing mobile devices.

Correct AnswerverifiedShow Answer

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
B

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
True

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified

Correct Answer
verified
search for media and SIM cards, seizing related peripherals and communication cables, charging stands, etc., how to isolate the device from the network(s), powering off issues.

Correct Answer
verified

Correct Answer
verified