Mobile Forensics - QUIZ

Word Cloud

First information to decode from a mobile backup?

Drag and Drop

Caselet: A popular social media influencer reports her phone stolen after a club event. Two days later, suspicious posts appear on her account promoting a questionable cryptocurrency. The phone is recovered when police arrest a man for pickpocketing.

Question? The influencer claims she never made those posts. What specific type of mobile data would be MOST valuable to prove or disprove her claim?​ ​

Placeholder

Drag these tiles and drop them in the correct blank above

Application usage logs showing which app was activ

The phone's call history 

Google Maps location history during posts time

The phone's battery level at the time of the posts

Fill in the Blanks

When a file is deleted from a mobile phone, the data isn't immediately erased but remains in the

space until overwritten.

Fill in the Blanks

To verify that a forensic image hasn't been altered during analysis, examiners compare

values before and after examination.

Match

Match the Investigation Type to the Most Relevant Data Source

• Stalking Case

• Fraud Investigation

• Intellectual Property Theft

• Suicide Investigation

Location history and geotagged photos

Banking app data and transaction alerts

Email attachments and cloud storage sync

Keyboard cache and search history

• Location history and geotagged photos

• Banking app data and transaction alerts

• Email attachments and cloud storage sync

• Keyboard cache and search history

Multiple Choice

An employee is suspected of leaking confidential company designs. Their corporate iPhone was seized. A logical extraction was performed, but no leaked files were found in the active storage.What should be the examiner's next step to find potential evidence?

• Close the case, as the logical extraction found nothing.

• Perform a physical extraction to search the unallocated space for deleted files.

• Contact Apple to get the data from iCloud.

• Return the phone to the employee.

Multiple Select

Which of the following are considered best practices when seizing a mobile device? (Select all that apply.)

• Document the device's condition with photographs.

• Place the device in a Faraday bag or enable Airplane mode.

• Use a portable power bank to maintain the device's charge if it's on.

• If the device is on, try to scroll through as much data as possible before it locks.

• If the device is off, turn it on to confirm it's working.

Drag and Drop

You find a photo of a stolen item on a suspect's phone, taken yesterday. Which of the image file would be most crucial for placing the suspect at a specific location?​ ​ ​

Placeholder

Drag these tiles and drop them in the correct blank above

GPS coordinates in the EXIF data

The camera model

The image resolution

location database

Dropdown

In the "Mobile Image Analysis" section, geographic coordinates and movement history fall under which category?​ ​

Select answer

Match

Match the following

• Physical Acquisition

• Logical Acquisition

• JTAG Acquisition

• File System Acquisition

Creates a complete memory image

Collects user-visible data

Connects to the circuit board

Copies the directory structure

• Creates a complete memory image

• Collects user-visible data

• Connects to the circuit board

• Copies the directory structure

Reorder

Reorder the following

• Seizure & Isolation

• Acquisition & Preservation

• Analysis & Examination

• Reporting & Presentation

1

2

3

4

• 1
• 2
• 3
• 4

Categorize

Options (4)

sms.db

calllog.db

contacts.db

accounts.db

Drag the following common database files to the category that best describes the information they typically contain.

Communications History

User Information