GASF practice question 12 of 15
What will happen when a user creates an encrypted backup of their personal iPhone on their work computer then later performs a backup to their personal computer at home?
Full set: 75 questionsThe setting to encrypt an iPhone backup is stored on the device itself, not on the computer performing the backup. When the user first created an encrypted backup on their work computer, they set a password, and the iPhone was configured to require encryption for all subsequent local backups. When the user later connects the same iPhone to their personal computer, the backup software (Finder on macOS or iTunes on Windows) will recognize this device-level setting and prompt the user to enter the previously established password to proceed with creating the new encrypted backup.
A. An iPhone can be backed up to multiple computers independently; deleting a backup from one computer is not a prerequisite for creating one on another.
B. The backup password is tied to the device, not the computer. The user must enter the existing password, not create a new one for the new computer.
D. Because the device is configured for encrypted backups, a password is required for any local backup on any computer until the setting is turned off.
1. Apple, Inc. (2024). About encrypted backups on your iPhone, iPad, or iPod touch. Apple Support, Article HT205220.
Reference: The documentation states, "To encrypt the backups for your device going forward, set a password-protected option in the Finder, the Apple Devices app, or iTunes." This indicates the setting applies to the device for all future backups, regardless of the host computer. The password is required to access or create these backups.
2. Zdziarski, J. (2017). iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets. O'Reilly Media.
Reference: Chapter 3, "The Backup Process," explains that when encryption is enabled, a flag is set on the device. "Once this option is selected, all future backups of this device will be encrypted... The encryption key for the backup is derived from the password the user supplies." This confirms the setting is persistent on the device and the original password is required. (Note: While a commercial book, it is authored by a leading expert and used as courseware in digital forensics programs at institutions like the SANS Institute).
3. Morrissey, S. (2016). iOS Forensic Analysis: for iPhone, iPad, and iPod touch. Apress.
Reference: Chapter 4, "iOS Backups," details the backup process. It clarifies that the encryption state is a property of the device's backup settings. When a backup is initiated, the host computer checks these settings. If encryption is enabled, the host system requires the password to proceed, as the key derivation process depends on it.
Keep practicing
Take the free GASF practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other GASF practice questions
- Question 3Which of the following can most forensics tools crack on an iOS device?
- Question 4Which iOS backup file will contain the last time the device was backed up?
- Question 5As part of your analysis of a legacy BlackBerry device, you examine the installed applica…
- Question 6Which file system is mostly found on Samsung devices?
- Question 7What does access to iOS DFU mode provide an examiner?
- Question 8When examining a file system acquisition of an Android device Which artifact must be carv…
