EMT Practice Test

1. Question Content...

---

Question1: Which of the following is a backup tool for smartphones?

Question2: What is being shown in the image below?

Question3: What type of acquisition has occurred for this device?

Question4: Examine the unpacked Android application below. Which important file, resident in most Android applications, is missing?

Question5: An analyst investigating a Nokia S60 Symbian device wants to know if an Adobe Flash file on the handset is compromised. Which file in the image will best target the Adobe Flash files?

Question6: Which of the following files contains details regarding the encryption state of an iTunes backup file?

Question7: Property list (Plist) files are used by iOS devices to store data. Which of the file formats below is common to plist files?

Question8: As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on applications that were accessed with the handset?

Question9: Which of the following actions described below would populate the suggestions table on an Android phone?

Question10: When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

Question11: You have conducted a keyword search over flash.bin and notice that multiple instances of the same data appear many times throughout the flash image. What is this an example of?

Question12: Which file type below is commonly associated with locational data and is an export option from within Cellebrite Physical Analyzer and XRY to provide detailed visual output of geographic information?

Question13: The device pictured below is in Download Mode to attempt a physical acquisition. What can be ascertained by viewing the Android boot screen below?

Question14: Where are iOS Class keys stored?

Question15: The files pictured below from a BlackBerry OS10 file system have a unique file extension. What can be concluded about these files?

Question16: Which of the following is the term for the SMS malware that sends text messages to a premium number generating large service bills for the user of the targeted device?

Question17: Cellebrite's Physical Analyzer will conduct a Quick Scan for images, which goes through and carves files that may have been deleted from the device. When carving for image files, which of the following methods is most effectively used to recover data?

Question18: What is often more of a challenge with mobile forensics than other areas of forensics?

Question19: What does the data string highlighted in blue represent in the File system path?

Question20: Where can an analyst find data to provide additional artifacts to support the evidence in the highlighted file?

Question21: Review the two highlighted sections in the hex output below from the file MP0c_000. Convert the phone number found in raw format extracted from a Chinese knock-off device.

Question22: Review the message database below. What can be determined based on the information provided?

Question23: Which of the following is required in addition to the Apple ID of the custodian to access IOS backup files that are stored in ICloud?

Question24: Which of the following items is found in the Kernel Space for an iOS device?

Question25: An analyst is investigating files on a Nokia S60 Symbian device and looking for data that would contain possible cell tower locations, date and time stamps, phone numbers and/or references to files saved on the device. Which of the follow files would contain user data that was created and stored on the device that meet this criteria?

Question26: What type of acquisition is being examined in the image below?

Question27: When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes even when the device is simply powered on. It is best practice to:

Question28: What does access to iOS DFU mode provide an examiner?

Question29: Which of the following is a unique 56 bit number assigned to a CDMA handset?

Question30: Which file will indicate if Siri was active on an iOS device?

Question31: Review the sample database. What is the BLOB column storing for this particular database table?

Question32: An analyst is reviewing the contents of a media card that was found without an associated device. Based on the image below, with which mobile device is it most likely that this device was once paired?

Question33: Which of the following files provides the most accurate reflection of the device's date/timestamp related to the last device wipe?

Question34: Which of the following is of most concern when attempting to root an Android device such as Google Glass when conducting a forensic acquisition?

Question35: Which cloud based system can be utilized by Android owners to backup user data?

Question36: Which of the following can most forensics tools crack on an iOS device?

Question37: What information can you determine by reviewing the (bp2p) file from a BlackBerry OS10 handset?

Question38: Which file, found natively on most Android devices, will contain location history such as coordinates, physical addresses and timestamps?

Question39: An Android device user is known to use Facebook to communicate with other parties under examination.
There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?

Question40: Analyze the two tables (Albums and Photos) provided from the Facebook database on an Android device located at the path: /data/data/com.facebook.katana/databases/fb.db.
Which photo was added to Facebook by the user of the device?

Question41: Which of the following operating systems are used by Blackberry 10 and found in some vehicles and medical devices?

Question42: Which iOS backup file will contain the last time the device was backed up?

Question43: Which file, located on the Android file system, may be examined to correlate files related to external SD cards that were once used in an Android device?

Question44: What information can be concluded by examining this XML file extracted from an Android device?

Question45: What is the extension used for BlackBerry 10 backup files?

Question46: Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?

Question47: In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

Question48: Using an emulator and running an application through a series of processes to figure out how it would behave on an actual device is called:

Question49: What are the three components that make up the International Mobile Subscriber Identity (IMSI)?

Question50: Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Question51: The jTAG method is designed to acquire data through which of the following?

Question52: Which of the following devices below runs the Apple iOS operating system?

Question53: Where would an examiner find evidence of an iOS update to device from one version to another?

Question54: What is the MAIN difference between a Full Root and a Shell/Soft Root?

Question55: In 2015, Apple's iTunes store was found to be hosting several malicious applications that were infected as a result of hacked version of the developer toolkit used to create applications. Which Apple developer suite was targeted?

Question56: How would an examiner review items deleted from a SQLITE database?

Question57: Which file system is mostly found on Samsung devices?

Question58: During the forensic analysis of a Nokia Symbian phone, you receive a SD card with files in the Nokia
\Content Copier folder. What data is present to examine?

Question59: What type of storage does an iOS device use for user data?

Question60: Examine the file, Bluetooth, what is the name of the device being examined?

Question61: Review the information contained within the Viber application running on an Android device. Which of the following can be determined?

Question62: When analyzing the WhatsApp timestamp "1461184912" in iOS what timestamp conversion should be used?

Question63: What will happen when a user creates an encrypted backup of their personal iPhone on their work computer then later performs a backup to their personal computer at home?

Question64: Which of the following chipsets is commonly found in knock-off handsets?

Question65: Which artifact(s) can be extracted from a logical image only if the device the image was acquired from was jailbroken?

Question66: Physical Analyzer provides a function to narrow down a search based on a timestamp, a type, a party or date. What is the name of this advanced searching capability?

Question67: Which of the following is one potential risk of using the ALWAYS OFF rule for handling cell phones?

Question68: Based on the image below, which file system is being examined?

Question69: What is a risk to the security of an iPhone backup if the user selects to set a password and encrypt their backup?

Question70: When examining the iOS device shown below the tool indicates that there are 4 chat messages recovered from the device. Which of the following locations may contain additional chat information?