A digital forensics team is investigating a cyberattack where multiple devices were compromised. Among the seized devices is an Android smartphone with evidence suggesting interaction with both…

Question

Options

• ATo confirm the operating system used on the compromised smartphone
• BTo identify the manufacturer of the Windows and Linux systems
• CTo establish a connection between different devices involved in the cyberattack
• DTo determine the brand and model of the Android smartphone

• A
  11% (2)
• B
  5% (1)
• C
  79% (15)
• D
  5% (1)

Explanation

This scenario aligns with CHFI v11 objectives under Mobile and IoT Forensics and Cross- Platform Digital Evidence Correlation. Modern cyberattacks frequently involve multiple devices and operating systems working together as part of a single attack chain. In mobile forensic investigations, Android and iOS devices often store artifacts that reflect interactions with external systems such as Windows and Linux machines. These artifacts may include USB connection logs, file transfer records, SSH keys, shared application data, cloud sync traces, or remnants of malware propagation. CHFI v11 emphasizes the importance of event correlation and timeline analysis across heterogeneous environments. By analyzing Windows-and Linux-related files found on a mobile device, investigators can establish relationships between compromised endpoints, reconstruct attacker movement, and identify how data or malware was transferred between systems. This cross-device correlation is essential for attributing actions, understanding lateral movement, and proving coordinated activity during an incident.

No community discussion yet for this question.