Smith, as a part his forensic investigation assignment, has seized a mobile device. He was asked to recover the Subscriber Identity Module (SIM card) data the mobile device. Smith found that the SIM was protected by a Personal identification Number (PIN) code but he was also aware that people generally leave the PIN numbers to the defaults or use easily guessable numbers such as 1234. He unsuccessfully tried three PIN numbers that blocked the SIM card. What Jason can do in this scenario to reset the PIN and access SIM data?

• A. He should again attempt PIN guesses after a time of 24 hours
• B. He should contact the device manufacturer for a Temporary Unlock Code (TUK) to gain access to the SIM
• C. He cannot access the SIM data in this scenario as the network operators or device manufacturers have no idea about a device PIN
• D. He should ask the network operator for Personal Unlock Number (PUK) to gain access to the SIM

File signature analysis involves collecting information from the __________ of a file to determine the type and function of the file

• A. First 10 bytes
• B. First 40 bytes
• C. First 20 bytes
• D. First 30 bytes

What is a chain of custody?

• A. It Is a document that lists chain of windows process events
• B. Chain of custody refers to obtaining preemptive court order to restrict further damage of evidence in electronic seizures
• C. It is a search warrant that is required for seizing evidence at a crime scene
• D. A legal document that demonstrates the progression of evidence as it travels from the original evidence location to the forensic laboratory

The Apache server saves diagnostic information and error messages that it encounters while processing requests. The default path of this file is usr/local/apache/logs/error.log in Linux. Identify the Apache error log from the following logs.

• A. http://victim.com/scripts/..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af./..%c0%af ./..%c0%af./../winnt/system32/cmd.exe?/c+di r+c:\wintt\system32\Logfiles\W3SVC1
• B. 127.0.0.1 - frank [10/Oct/2000:13:55:36-0700] "GET /apache_pb.grf HTTP/1.0" 200 2326
• C. [Wed Oct 11 14:32:52 2000] [error] [client 127.0.0.1] client denied by server configuration: /export/home/live/ap/htdocs/test
• D. 127.0.0.1 --[10/Apr/2007:10:39:11 +0300] ] [error] "GET /apache_pb.gif HTTP/1.0' 200 2326

Network forensics can be defined as the sniffing, recording, acquisition and analysis of the network traffic and event logs in order to investigate a network security incident.

• A. True
• B. False