Exam 20: Mobile Device Forensics

What does 1G consist of?

What is another name for a temporal chain of events?

How many types of chains of evidence are there?

Describe the process of using each generation of mobile device to create a timeline and correlate events on the device.

A digital forensic investigation depends upon timelines for its success. When overlaid on the timelines of a physical crime, the timelines from mobile devices and computers provide an excellent yardstick by which to measure the play of events surrounding the crime itself.

What does 2G consist of?

Causal chains of evidence describe the events of a crime in terms of cause and effect.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -GSM (Global System for Mobile Communication)

All mobile devices have architecture.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Broadband

Users of mobile devices need to manually perform various forms of housekeeping from small simple tasks like doing routine checks of address books and contacts to larger tasks such as connecting to local WiFi connections, formatting storage, clearing out device memory, or forcing background programs to close.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -CDMA (Code Division Multiple Access)

Mobile devices began as an outgrowth of ship-to-shore radios in World War I.

What does 4G consist of?

In many ways mobile device forensics is similar to ________ forensics.

3G and 4G mobile devices have the ability to download and install ________, the same as a PC or MAC.

From a forensic perspective it is a toss-up as to how much data you may be able to extract from a 2G device.

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -WiFi

Match the word in Column 1 to its definition in Column 2. Each answer can only be used once. A)A cellular network facility that allows users to send and receive text messages B)A software mechanism that defines the way files are named, stored, organized, and accessed C)A set of standards for second-generation cellular networks D)Assessment of the actual geographical location of a mobile device E)A custom-designed program that controls the components of mobile devices and facilitates how they function. F)A snapshot of the file system of a mobile device G)A storage expansion card for a mobile device H)The traditional method of modulating radio signals so that they can carry information I)A term describing a wireless Local Area Network J)A spread-spectrum technology for cellular networks K)A duplicate of data located on a mobile device L)The smart card that is inserted into a mobile device that identifies the user account to the network, handles authentication, and provides storage for basic user data and network information M)The basic components of a mobile device N)A communication channel that can provide higher-speed data communication than a standard telephone circuit O)A system for determining position by comparing radio signals from several satellites -Geolocation

When a mobile device is set to use WiFi, it will recognize any WiFi network in its range but may not be able to join the network because of the security settings on the WiFi access point-the mobile device will see it and note that it exists. When that happens, the device takes note of the network and logs it.