A digital forensic investigator is examining a mobile device recovered from a suspect in a cybercrime case. The device appears to be running a custom operating system configuration that allows for…

Question

Options

• AInstalling a custom ROM on the Android device
• BExploiting a vulnerability in the iOS device's firmware
• CRooting the Android device
• DJailbreaking the iOS device

• A
  3% (1)
• B
  6% (2)
• C
  77% (27)
• D
  14% (5)

Explanation

According to the CHFI v11 Mobile and IoT Forensics domain, rooting an Android device is the most common and direct method used to obtain elevated (superuser) privileges and unrestricted access to system resources. Rooting allows a user to bypass Android's built-in security restrictions and gain full control over the operating system, including access to protected directories, system binaries, kernel parameters, and hardware interfaces. CHFI v11 explains that once an Android device is rooted, the user can modify system files, install unauthorized applications, disable security controls, manipulate logs, and conceal malicious activity--making rooting a frequent technique in cybercrime and anti-forensics scenarios. From a forensic perspective, rooting significantly impacts evidence integrity and is often identified through artifacts such as the presence of su binaries, modified boot images, or root management While installing a custom ROM does modify the operating system, it does not inherently guarantee unrestricted system access unless the device is rooted. Jailbreaking applies specifically to iOS devices, not Android. Exploiting an iOS firmware vulnerability may lead to jailbreaking, but the scenario does not indicate an iOS environment. CHFI v11 emphasizes that identifying whether a device has been rooted is critical during mobile investigations, as it affects data acquisition methods, trustworthiness of artifacts, and anti-forensic risk assessment.

No community discussion yet for this question.