GCFA · Question #325
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that…
The correct answer is A. /private/var. On iPhone, the user data partition (second partition) is mounted at /private/var, which stores all user-generated data, application data, and settings separate from the OS partition.
Question
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that this iphone contains some sensitive information. Adam knows that the storage partition of the iphone is divided into two partitions. The first partition is used for the operating system. Other data of iphone is stored in the second partition. Which of the following is the name with which the second partition is mounted on the iphone?
Options
- A/private/var
- B/var/data
- C/var/private
- D/data/var
How the community answered
(44 responses)- A82% (36)
- B11% (5)
- C2% (1)
- D5% (2)
Why each option
On iPhone, the user data partition (second partition) is mounted at /private/var, which stores all user-generated data, application data, and settings separate from the OS partition.
The iPhone file system is divided into two partitions: the first is mounted at / and holds the operating system (iOS), while the second partition containing user data, application data, and media is mounted at /private/var. This is the standard iOS file system layout and is a key fact in iPhone forensic investigations.
/var/data is not a valid mount point on the iPhone file system and does not correspond to any standard iOS partition.
/var/private reverses the correct path components and is not a valid iOS mount point.
/data/var is not a valid mount point on the iPhone file system and does not exist in the standard iOS partition layout.
Concept tested: iPhone iOS file system partition structure
Source: https://support.apple.com/guide/security/security-of-runtime-process-sec15bfe098e/web
Topics
Community Discussion
No community discussion yet for this question.