GASF practice question 12 of 15

What will happen when a user creates an encrypted backup of their personal iPhone on their work computer then later performs a backup to their personal computer at home?

Full set: 75 questions
Answer options
A: The user will not be able to create the backup until they have deleted the original on their work computer
B: The user will be required to enter a new backup password on their personal computer
C: The user will be required to enter their backup password to start the backup process Correct answer
D: The user will not need to enter a password on the personal computer
Correct Answer:
C. The user will be required to enter their backup password to start the backup process
Explanation

The setting to encrypt an iPhone backup is stored on the device itself, not on the computer performing the backup. When the user first created an encrypted backup on their work computer, they set a password, and the iPhone was configured to require encryption for all subsequent local backups. When the user later connects the same iPhone to their personal computer, the backup software (Finder on macOS or iTunes on Windows) will recognize this device-level setting and prompt the user to enter the previously established password to proceed with creating the new encrypted backup.

Why Incorrect

A. An iPhone can be backed up to multiple computers independently; deleting a backup from one computer is not a prerequisite for creating one on another.
B. The backup password is tied to the device, not the computer. The user must enter the existing password, not create a new one for the new computer.
D. Because the device is configured for encrypted backups, a password is required for any local backup on any computer until the setting is turned off.

References

1. Apple, Inc. (2024). About encrypted backups on your iPhone, iPad, or iPod touch. Apple Support, Article HT205220.

Reference: The documentation states, "To encrypt the backups for your device going forward, set a password-protected option in the Finder, the Apple Devices app, or iTunes." This indicates the setting applies to the device for all future backups, regardless of the host computer. The password is required to access or create these backups.

2. Zdziarski, J. (2017). iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets. O'Reilly Media.

Reference: Chapter 3, "The Backup Process," explains that when encryption is enabled, a flag is set on the device. "Once this option is selected, all future backups of this device will be encrypted... The encryption key for the backup is derived from the password the user supplies." This confirms the setting is persistent on the device and the original password is required. (Note: While a commercial book, it is authored by a leading expert and used as courseware in digital forensics programs at institutions like the SANS Institute).

3. Morrissey, S. (2016). iOS Forensic Analysis: for iPhone, iPad, and iPod touch. Apress.

Reference: Chapter 4, "iOS Backups," details the backup process. It clarifies that the encryption state is a property of the device's backup settings. When a backup is initiated, the host computer checks these settings. If encryption is enabled, the host system requires the password to proceed, as the key derivation process depends on it.

Scroll to Top