Computer Hacking Forensic Investigator (CHFI v10) — Question 292

A forensic investigator is examining a potential intrusion involving an Amazon Echo. The investigator has acquired an affected Echo and the smartphone synced to it. For further data analysis, he needs to retrieve relevant database files from the smartphone. Which files will the investigator primarily focus on to retrieve essential information?

Answer options

• A. /data/data/com.amazon.dee.app/databases/map_data_storage_v2.db and /data/data/com.amazon.dee.app/databases/DataStore.db
• B. /data/data/com.amazon.dee.app/databases/DataStore.db and /data/data/com.amazon.dee.app/databases/map_data_storage_v3.db
• C. /data/data/com.amazon.dee.app/databases/map_data_storage_v1.db and /data/data/com.amazon.dee.app/databases/DataStore.db
• D. /data/data/com.amazon.dee.app/databases/map_data_storage_v2.db and /data/data/com.amazon.dee.app/databases/DeviceInfo.db

Correct answer: A

Explanation

The correct answer is A because those database files, map_data_storage_v2.db and DataStore.db, contain essential information related to the Amazon Echo's operations and user interactions. Options B, C, and D include either outdated database versions or irrelevant files that do not hold the crucial data needed for the investigation.