Guide to Computer Forensics and Investigations, 5th Edition
Ch. 12 Solutions-1
Chapter 12 Solutions
Review Questions
1. List four places where mobile device information might be stored.
internal memory, SIM card, external/removable memory cards, the system server
2. Typically, you need a search warrant to retrieve information from a service provider. True or
False?
3. The term TDMA refers to which of the following? (Choose all that apply.)
4. What’s the most commonly used cellular network worldwide?
GSM
5. Which of the following relies on a central database that tracks account data, location data, and
subscriber information?
6. GSM divides a mobile station into ______________ and __________________.
SIM card and ME (mobile equipment)
7. SD cards have a capacity up to which of the following?
8. Describe two ways you can isolate a mobile device from incoming signals.
9. Which of the following categories of information is stored on a SIM card? (Choose all that
apply.)
10. Most SIM cards allow ___________ access attempts before locking you out.
11. SIM card readers can alter evidence by showing that a message has been read when you view
it. True or False?
12. List two peripheral memory cards used with PDAs.
13. When acquiring a mobile device at an investigation scene, you should leave it connected to a
laptop or tablet so that you can observe synchronization as it takes place. True or False?
Guide to Computer Forensics and Investigations, 5th Edition
Ch. 12 Solutions-2
14. Remote wiping of a mobile device can result in which of the following? (Choose all that
apply.)
15. In which of the following cases did the U.S. Supreme Court require using a search warrant to
examine the contents of mobile devices?
16. When investigating social media content, evidence artifacts can vary, depending on the social
media channel and the device. True or False?
Hands-On Projects
Hands-On Project 12-1
Students should notice, among other information, that Nau appears to be picking up prescription drugs for
Sebastian and conclude there’s enough evidence to continue the investigation.
Hands-On Project 12-2
Step 2: International Mobile Subscriber Identity (IMSI) is a unique 15-digit code for identifying a user on a
GSM network. It consists of three components: Mobile Country Code (MCC), Mobile Network Code
(MNC), and Mobile Subscriber Identity Number (MSIN). The IMSI is stored in the SIM card (www.gsm-
security.net/faq/imsi-international-mobile-subscriber-identity-number-gsm.shtml). In addition, students
should find definitions for these items:
• Public Land Mobile Network (PLMN): A method of establishing a roaming service for a mobile phone
Step 3: The phrase noted is part of the GSM requirements for identifying a SIM user with a mobile station.
Hands-On Project 12-3
Step 9: Nau’s full first name is Nauba.
The messages should indicate that Nau and Sebastian met regularly to exchange items—perhaps drugs, as
indicated by the warrant.
Guide to Computer Forensics and Investigations, 5th Edition
Ch. 12 Solutions-3
Hands-On Project 12-4
Case Projects
Case Project 12-1
Most of the tools covered in this chapter are logical extractors, and a few are physical extractors. Students
should note the limitations of each type.
Case Project 12-2