Quiz 20: Mobile Device Forensics

What does 1G consist of? A)Analog networks B)Digital networks C)Broadband networks D)Native IP networks

What does 2G consist of? A)Analog networks B)Digital networks C)Broadband networks D)Native IP networks

What does 3G consist of? A)Analog networks B)Digital networks C)Broadband networks D)Native IP networks

What does 4G consist of? A)Analog networks B)Digital networks C)Broadband networks D)Native IP networks

In 2001, mobile Broadband networks (3G)arrived on the scene in what country? A)North Korea B)China C)Japan D)India

The Smartphone was developed under which technology? A)Digital networks B)Broadband networks C)Native IP networks D)Analog networks

Since the ________, the concepts of handoff and frequency reuse allowed users to move between cells without dropping calls. A)1960s B)1970s C)1980s D)1990s

What type of network devices started using operating systems? A)1G B)2G C)3G D)4G

Feature phones have divergent - based upon the phone - feature sets. These core features usually are: A)Phone and text. B)E-mail and camera. C)Applications and media. D)Both A and B

Working on what type of surface increases the danger of static electricity? A)Metal tables B)Hardwood floors C)Carpet D)Lab desk

It may not be possible to recover deleted file items from a mobile device, such as: A)E-mails. B)Text messages. C)Photos. D)All the above

How many types of chains of evidence are there? A)1 B)2 C)4 D)5

When working on electronic devices, what should you use to dissipate any static charge that might damage electronic chips? A)Rubber-soled shoes B)Prevention of physical contact C)Gloves D)Grounded anti-static wristband

What does SIM stand for? A)Subscriber Identity Module B)Source Information Memory C)Simple Identification Mount D)Subscriber Identification Memory

What would an investigator do with the SIM card to retain a perfect copy for evidentiary purposes? A)Take a picture B)Upload to a PC C)Clone the SIM D)Properly store in evidence

What does the ICCID contain? A)IIN (issuer identification number) B)UPC (universal purchase code number) C)PID (phone identification number) D)IP address

Because a mobile device is similar a computer and transmits wireless signals, what laws does an investigator need to follow? A)Radio laws B)First Amendment rights C)Computer laws D)Both A and C

What feature on a mobile device can help an investigator establish a timeline? A)GPS B)NFC C)Android Beam D)Bluetooth

What is another name for a temporal chain of events? A)Cause and effect B)A timeline C)Crime assessment D)Crime log

Mobile devices began as an outgrowth of ship-to-shore radios in World War I.

2G appeared in the 1990s using two standards: GSM & CDMA.

Analog phones have divergent feature sets. The core features usually were phone, e-mail, text, and camera.

2G and 3G phones are closest in architecture and design to a PC.

Just because an app is written for Apple's iOS operating system does not mean that it runs equally well or behaves the same on the iPad and iPhone.

From a forensic perspective it is a toss-up as to how much data you may be able to extract from a 2G device.

It may not be possible to recover deleted file items from a mobile device such as e-mails, texts, and photos.

Physical extraction is a snapshot of the file system showing what the file system wants you to see.

Logical extractions are useful only when the physical option is not available because of the device itself.

All mobile devices have architecture.

SD cards and SIM cards perform the same way.

Each SIM card has an international mobile subscriber identity number that associates the phone with the subscriber's mobile network.

All mobile devices use SIM cards.

An integrated circuit identification (ICCID)number is located on each SIM.

Even though some mobile devices are really small computers with computer-like operating systems, they can usually be examined using typical computer forensic tools.

By cloning the SIM card, the investigator retains a perfect copy for evidentiary purposes.

Blackberry is the only mobile device that can be recovered directly.

One interesting aspect of mobile device forensics is geolocation. Some devices and many apps report out the geographical location of the device. That can make it much easier to track the owner's movements.

A digital forensic investigation depends upon timelines for its success. When overlaid on the timelines of a physical crime, the timelines from mobile devices and computers provide an excellent yardstick by which to measure the play of events surrounding the crime itself.

Causal chains of evidence describe the events of a crime in terms of cause and effect.

Some tools, such as Cellebrite's UFED Touch, are quite clear about which devices support physical extraction.

You can't use a 1G phone to track a 15-year-old crime.

When a mobile device is set to use WiFi, it will recognize any WiFi network in its range but may not be able to join the network because of the security settings on the WiFi access point-the mobile device will see it and note that it exists. When that happens, the device takes note of the network and logs it.

Users of mobile devices need to manually perform various forms of housekeeping from small simple tasks like doing routine checks of address books and contacts to larger tasks such as connecting to local WiFi connections, formatting storage, clearing out device memory, or forcing background programs to close.

The amount of information we can get from a mobile device varies greatly with the device in question.

Since the 1960s, the concepts of handoff and frequency reuse allowed users to move between ________ without dropping a call.

In many ways mobile device forensics is similar to ________ forensics.

When ________ was launched in Japan in 2001, moving photos over the network, streaming video and television, video chat, and other advanced services now could be supported.

________ phones have divergent (based upon the phone)feature sets. The core features are usually phone, e-mail, text, and camera.

3G and 4G mobile devices have the ability to download and install ________, the same as a PC or MAC.

________ devices were the first to use an operating system.

When working with mobile devices, ________ searching is probably the most useful source of information available to the investigator.

________ forensic images are bit-by-bit copies of the file system, including deleted data.

Each SIM has an international mobile subscriber identity (IMSI)number that associates the phone with the subscriber's mobile ________.

It often is desirable to ________ the SIM in much the same way one would take a physical image of the mobile device or a computer.

________ crime assessment is a technique that can be used when faced with a physical crime (murder, rape, robbery, etc.)and there is a digital element to it-a computer, cell phone, or other mobile device.

Tools such as ________ and MPE+ greatly simplify mobile forensic work.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Analog

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Architecture

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Broadband

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -CDMA (Code Division Multiple Access)

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -File system

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Geolocation

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -GPS (Global Positioning System)

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -GSM (Global System for Mobile Communication)

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Logical extraction

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Operating system

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Physical extraction

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -SIM card

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -SD card

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -SMS (Short Message Service)

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -WiFi

What value can be gleaned from each generation of mobile device (1G, 2G, 3G, and 4G)? What are their strengths and weaknesses?

Describe the two different types of chain of evidence and how they can be used in the investigative process.

Even though mobile devices are really small computers with computer-like OSs, they usually cannot be examined using typical computer forensic tools. Elaborate on some of the differences between examining a 4G smartphone and a computer.

Describe the process of using each generation of mobile device to create a timeline and correlate events on the device.

If there is a GPS capability on a smartphone, how might the investigator use it in the investigation?

When should an examiner do a physical extraction versus a logical extraction, or both?