Computer Hacking Forensic Investigator (CHFI v10) — Question 411

A forensic investigator has collected a compromised Amazon Echo Dot and a smartphone from a crime scene. The Alexa app on the smartphone is synced with the Echo Dot. To begin investigating these devices, the investigator needs to obtain certain artifacts. In this scenario, which of the following sequence of steps should the investigator follow to acquire the necessary artifacts for a client-based analysis?

Answer options

• A. Retrieve database files using the adb pull command -> Generate an image of the firmware -> Parse database files -> Conduct data analysis
• B. Parse database files -> Retrieve database files using the adb pull command -> Generate an image of the firmware -> Conduct data analysis
• C. Generate an image of the firmware -> Retrieve database files using the adb pull command -> Parse database files -> Conduct data analysis
• D. Retrieve database files using the adb pull command -> Parse database files -> Generate an image of the firmware -> Conduct data analysis

Correct answer: A

Explanation

The correct answer is A because the investigator needs to first retrieve the database files using the adb pull command to obtain data from the smartphone. After that, generating an image of the firmware allows for a thorough analysis of the Echo Dot's operating system. The other options do not follow the correct order needed for effective analysis.