Download PrepIQ Digital Intelligence Advanced Mobile Forensic Analysis with Python Ultimate Exam and more Exams Technology in PDF only on Docsity!
Forensic Analysis with Python Ultimate Exam
Question 1. Which Python built-in function is most appropriate for reading a binary file containing a raw mobile image? A) open() with mode "r" B) open() with mode "rb" C) csv.reader() D) json.load() Answer: B Explanation: Mode "rb" opens the file for reading in binary mode, preserving the exact byte sequence needed for forensic analysis. Question 2. In a forensic Python script, which data type is best suited for storing a list of recovered SMS timestamps for later sorting? A) dict B) set C) list D) tuple Answer: C Explanation: A list preserves order and allows duplicate timestamps; it can be sorted with list.sort(). Question 3. Which control-structure pattern efficiently filters artifacts to export only those whose timestamp falls between two epoch values? A) while loop with break B) try/except block C) if/elif/else statement D) for loop with continue Answer: C Explanation: An if/elif/else statement directly tests the condition if start <= ts <= end: and decides whether to export. Question 4. When modularising forensic code, which Python construct should be used to encapsulate reusable logic for parsing a specific app’s database?
Forensic Analysis with Python Ultimate Exam
A) Class inheritance B) Lambda expression C) Function definition D) Global variable Answer: C Explanation: Defining a function allows the parsing logic to be called repeatedly with different inputs, promoting reuse and readability. Question 5. Which standard library module provides the binascii.unhexlify() function useful for converting hex strings extracted from a SIM card dump? A) os B) sys C) binascii D) hashlib Answer: C Explanation: The binascii module contains utilities for binary-ASCII conversions, including unhexlify(). Question 6. A script fails with a SyntaxError at line 12. Which of the following is the most likely cause? A) Incorrect indentation B) Division by zero C) Misspelled variable name D) Using a deprecated function Answer: A Explanation: SyntaxError typically arises from malformed code such as missing colons or inconsistent indentation. Question 7. In mobile forensics, which representation is commonly used to store a device’s IMEI in a SQLite table? A) UTF-8 string
Forensic Analysis with Python Ultimate Exam
C) 0x25 0x50 0x44 0x D) 0x42 0x4D 0x38 0x Answer: B Explanation: JPEG files begin with 0xFFD8FFE0 (or variations like FFD8FFE1). Question 11. Which regular expression correctly matches a 15-digit IMEI number in a forensic dump? A) \b\d{15}\b B) \b[0-9]{14,16}\b C) \bIMEI:\s*\d{15}\b D) \b\d{5}-\d{5}-\d{5}\b Answer: A Explanation: \b\d{15}\b captures exactly 15 consecutive digits bounded by word boundaries. Question 12. In SQLite, which page type stores the actual table rows for a mobile messaging database? A) B-tree leaf page B) Index page C) Overflow page D) Freelist page Answer: A Explanation: B-tree leaf pages hold the row records; index pages contain only keys. Question 13. When using Python’s sqlite3 module, which method executes a parameterised SELECT query safely? A) execute("SELECT * FROM msgs WHERE id = " + user_input) B) execute("SELECT * FROM msgs WHERE id = ?", (user_input,)) C) execute("SELECT * FROM msgs WHERE id = %s" % user_input) D) execute("SELECT * FROM msgs WHERE id = :id", {"id": user_input})
Forensic Analysis with Python Ultimate Exam
Answer: B Explanation: Using ? placeholders with a tuple prevents SQL injection and handles quoting automatically. Question 14. To recover deleted rows from a SQLite database, which SQLite structure must be examined? A) WAL file B) Master table C) Freelist trunk and leaf pages D) Temporary tables Answer: C Explanation: Deleted rows are often left on freelist trunk/leaf pages, awaiting reuse. Question 15. Which SQL clause is essential when joining a contacts table from contacts.db with a messages table from msg.db based on the contact’s phone number? A) GROUP BY B) ORDER BY C) INNER JOIN ON contacts.phone = msgs.sender D) UNION ALL Answer: C Explanation: An INNER JOIN with the appropriate ON condition links records across databases. Question 16. Which Python library provides the plistlib module for parsing binary and XML property lists on iOS devices? A) json B) xml.etree C) plistlib (standard library) D) yaml Answer: C
Forensic Analysis with Python Ultimate Exam
Question 20. Which API method would you call in Cellebrite Physical Analyzer to programmatically add a custom parser plugin? A) add_parser() B) register_plugin() C) load_module() D) import_parser() Answer: B Explanation: The register_plugin() method registers custom parsers with the platform’s API. Question 21. When mapping script output to the “Chats” category in a forensic tool, which metadata field is most critical? A) timestamp B) direction (incoming/outgoing) C) conversation_id D) file_path Answer: C Explanation: conversation_id groups messages into a single chat thread, enabling correct categorisation. Question 22. Which Python construct allows bulk de-duplication of location points based on identical latitude/longitude pairs? A) List comprehension with set() B) Nested for-loops C) Recursive function D) Global variable tracking Answer: A Explanation: Converting the list of tuples to a set removes duplicate coordinate pairs efficiently.
Forensic Analysis with Python Ultimate Exam
Question 23. In a forensic environment, which environment variable is commonly used to point Python to the forensic tool’s library directory? A) PYTHONPATH B) PATH C) LD_LIBRARY_PATH D) FORENSEC_ROOT Answer: A Explanation: PYTHONPATH tells Python where to locate additional modules and plugins. Question 24. Which exception should be caught when a Python script attempts to open a non-existent SQLite file? A) IOError B) FileNotFoundError C) sqlite3.OperationalError D) ValueError Answer: B Explanation: FileNotFoundError is raised when the file path does not exist. Question 25. What is the purpose of the SQLite Write-Ahead Log (WAL) file in mobile forensic acquisition? A) Stores schema definitions only B) Holds uncommitted transactions for crash recovery C) Contains only deleted records D) Acts as a backup of the main database Answer: B Explanation: The WAL records changes before they are written to the main database, useful for reconstructing recent activity. Question 26. Which Python statement correctly imports the os module and then changes the current working directory to /mnt/evidence?
Forensic Analysis with Python Ultimate Exam
C) codecs.decode() D) urllib.parse.unquote() Answer: B Explanation: base64.b64decode() converts Base64 text back to raw bytes. Question 30. Which of the following best describes the purpose of a “freelist trunk page” in SQLite? A) Stores table schema definitions B) Holds pointers to free leaf pages for reuse C) Contains index entries for fast lookup D) Records transaction logs Answer: B Explanation: A freelist trunk page links to free leaf pages that can be reallocated for new data. Question 31. In Python, which method converts a list of integers representing bytes into a bytes object suitable for writing to a file? A) bytes(list_of_ints) B) list_of_ints.to_bytes() C) bytearray(list_of_ints).encode() D) str(list_of_ints) Answer: A Explanation: bytes() accepts an iterable of integers (0-255) and returns a bytes object. Question 32. Which attribute of the os.stat_result object provides the size of a file in bytes? A) st_mode B) st_size C) st_mtime D) st_ctime
Forensic Analysis with Python Ultimate Exam
Answer: B Explanation: st_size is the file size in bytes. Question 33. When analysing an iOS backup, which file extension typically indicates a binary plist containing app preferences? A) .plist B) .json C) .db D) .xml Answer: A Explanation: .plist files may be binary or XML; iOS app preferences are stored in binary plists. Question 34. Which Python statement correctly decodes a binary plist stored in variable data? A) plistlib.loads(data) B) plistlib.load(data) C) plistlib.decode(data) D) plistlib.parse(data) Answer: A Explanation: plistlib.loads() parses a bytes object containing a binary plist. Question 35. A forensic analyst needs to extract the device’s Wi-Fi SSID history from iOS. Which SQLite table typically contains this information? A) WiFiNetwork in Wifi.db B) network in system.db C) known_networks in NetworkInfo.db D) wifi_profiles in Preferences.db Answer: C Explanation: known_networks in NetworkInfo.db stores SSID, BSSID, and timestamps.
Forensic Analysis with Python Ultimate Exam
Question 39. When parsing Android’s mmssms.db, which column stores the raw PDU of an SMS message? A) address B) date C) pdu D) type Answer: C Explanation: The pdu column contains the encoded SMS payload. Question 40. Which Python function can be used to convert a Unix epoch timestamp (seconds) to a readable UTC datetime string? A) time.strftime() B) datetime.datetime.utcfromtimestamp() C) os.path.getmtime() D) calendar.timegm() Answer: B Explanation: datetime.datetime.utcfromtimestamp() returns a datetime object in UTC. Question 41. In a forensic script, you need to ensure that a file is closed even if an exception occurs. Which construct guarantees this? A) try/except only B) with open(...) as f: C) finally block without try D) Manual f.close() after try Answer: B Explanation: The with statement automatically calls close() on exit, regardless of exceptions. Question 42. Which SQLite pragma can be executed to enable reading of the WAL file without copying it?
Forensic Analysis with Python Ultimate Exam
A) PRAGMA journal_mode=DELETE; B) PRAGMA wal_checkpoint; C) PRAGMA journal_mode=WAL; D) PRAGMA foreign_keys=ON; Answer: C Explanation: Setting journal_mode=WAL tells SQLite to use the WAL file for reads. Question 43. Which of the following is a common indicator that a Python script is suffering from a logical error rather than a syntax error? A) The script fails to start at all. B) The script runs but produces unexpected output. C) The interpreter raises IndentationError. D) The script crashes with ImportError. Answer: B Explanation: Logical errors allow the script to execute, but the output is incorrect. Question 44. When decoding a Protobuf message without a .proto file, which Python tool can help infer the schema? A) protobuf-json B) protobuf-inspector C) google.protobuf.text_format D) protobuf-decoder (third-party) Answer: D Explanation: Third-party tools like protobuf-decoder can attempt schema inference from raw bytes. Question 45. Which Android permission is required for a forensic tool to read the contacts2.db file directly from the device’s data partition? A) READ_CONTACTS
Forensic Analysis with Python Ultimate Exam
D) threading without a pool Answer: B Explanation: ThreadPoolExecutor offers an easy-to-use thread pool for I/O-bound tasks like DB reads. Question 49. Which file extension is commonly associated with Android’s binary XML format that must be converted before human reading? A) .xml B) .bxml C) .axml D) .binaryxml Answer: C Explanation: Android stores many resources as .axml (Android binary XML). Question 50. When parsing a binary plist, which flag indicates that the object is a UID rather than a standard integer? A) High-order bit set to 1 B) Object type code 0x08 C) Length byte equals 0xFF D) Presence of the string “UID” Answer: B Explanation: In binary plists, type code 0x08 denotes a UID object. Question 51. Which of the following Python statements correctly writes a list of dictionaries records to a JSON file out.json with indentation? A) json.dump(records, open("out.json","w")) B) json.dumps(records, indent=4, file=open("out.json","w")) C) json.dump(records, open("out.json","w"), indent=4) D) json.dump(records, open("out.json","w"), ensure_ascii=False) Answer: C
Forensic Analysis with Python Ultimate Exam
Explanation: json.dump(..., indent=4) writes formatted JSON; option C is syntactically correct. Question 52. In a forensic workflow, which step should occur before parsing SQLite databases to ensure data integrity? A) Hash the raw image file B) Export tables to CSV C) Delete temporary files D) Run a full-text search Answer: A Explanation: Computing a hash (e.g., SHA-256) verifies that the image has not been altered prior to analysis. Question 53. Which SQLite command can be used to view the schema of a table named messages? A) SELECT * FROM messages; B) PRAGMA table_info(messages); C) DESCRIBE messages; D) SHOW CREATE TABLE messages; Answer: B Explanation: PRAGMA table_info(table_name); returns column definitions. Question 54. When extracting a JPEG from a raw image, which additional byte sequence marks the end of the file? A) 0x00 0x00 0x00 0x00 B) 0xFF 0xD9 C) 0x42 0x4D D) 0x89 0x50 Answer: B Explanation: JPEG files terminate with the EOI marker 0xFFD9.
Forensic Analysis with Python Ultimate Exam
A) UnicodeDecodeError B) binascii.Error C) ValueError D) TypeError Answer: B Explanation: binascii.Error indicates invalid Base64 characters when validation is enabled. Question 59. When using sqlite3.Row as a row factory, how can you access the column sender by name? A) row[‘sender’] B) row.sender C) row.get('sender') D) All of the above Answer: D Explanation: With sqlite3.Row, items can be accessed via dict-style, attribute-style, or get(). Question 60. Which of the following best describes the purpose of the binwalk tool when used in mobile forensic analysis? A) Extracts network packets B) Carves files based on magic signatures from raw images C) Parses XML plists D) Decrypts encrypted databases Answer: B Explanation: binwalk scans binary blobs for known signatures and extracts embedded files. Question 61. In iOS backups, the file Manifest.db is a SQLite database that maps original file paths to which identifier? A) SHA-1 hash of the file content
Forensic Analysis with Python Ultimate Exam
B) UUID string used in the backup folder C) File size in bytes D) Encryption key ID Answer: B Explanation: Manifest.db links each original path to a UUID filename stored in the backup directory. Question 62. Which Python standard library module provides functions for handling time zone conversions, useful when normalising timestamps from different mobile OSes? A) datetime with pytz (third-party) B) time alone C) zoneinfo (Python 3.9+) D) calendar Answer: C Explanation: zoneinfo (available from Python 3.9) offers IANA time-zone data for conversions. Question 63. To identify a potential deleted record in a SQLite file, which byte pattern in the page header often indicates a freeblock? A) 0x00 0x00 B) 0xFF 0xFF C) 0x05 (freeblock flag) D) 0x0D (leaf table flag) Answer: C Explanation: In SQLite page headers, 0x05 denotes a freeblock entry. Question 64. Which Android system property stores the device’s IMEI when the device is not using a dual-SIM configuration? A) ro.serialno B) ro.boot.imei
