nerdexam
GIAC

GCFA · Question #325

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that…

The correct answer is A. /private/var. On iPhone, the user data partition (second partition) is mounted at /private/var, which stores all user-generated data, application data, and settings separate from the OS partition.

Advanced Mac & Linux Forensics

Question

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate an iphone, which is being seized from a criminal. The local police suspect that this iphone contains some sensitive information. Adam knows that the storage partition of the iphone is divided into two partitions. The first partition is used for the operating system. Other data of iphone is stored in the second partition. Which of the following is the name with which the second partition is mounted on the iphone?

Options

  • A/private/var
  • B/var/data
  • C/var/private
  • D/data/var

How the community answered

(44 responses)
  • A
    82% (36)
  • B
    11% (5)
  • C
    2% (1)
  • D
    5% (2)

Why each option

On iPhone, the user data partition (second partition) is mounted at /private/var, which stores all user-generated data, application data, and settings separate from the OS partition.

A/private/varCorrect

The iPhone file system is divided into two partitions: the first is mounted at / and holds the operating system (iOS), while the second partition containing user data, application data, and media is mounted at /private/var. This is the standard iOS file system layout and is a key fact in iPhone forensic investigations.

B/var/data

/var/data is not a valid mount point on the iPhone file system and does not correspond to any standard iOS partition.

C/var/private

/var/private reverses the correct path components and is not a valid iOS mount point.

D/data/var

/data/var is not a valid mount point on the iPhone file system and does not exist in the standard iOS partition layout.

Concept tested: iPhone iOS file system partition structure

Source: https://support.apple.com/guide/security/security-of-runtime-process-sec15bfe098e/web

Topics

#iPhone forensics#iOS partition structure#/private/var#mobile device forensics

Community Discussion

No community discussion yet for this question.

Full GCFA Practice