Chapter 34 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and rationale at the bottom. Decide before you scroll — in IoT work the wrong assumption (the footage exists, the timestamp is Unix, the port is authorization) is what loses cases.

Multiple choice

Q1. In the three-tier model of IoT evidence, the richest data is usually found in the tier that is also the hardest to reach. That tier is: - A) On the device itself (Tier 1) - B) In the companion app on the owner's phone (Tier 2) - C) In the vendor's cloud (Tier 3) - D) In the device's RAM

Q2. An Amazon Alexa voice-history record stores creationTimestamp as 1700000000123. To turn this into a correct UTC time you must first: - A) Treat it directly as Unix seconds - B) Divide by 1,000 — it is epoch milliseconds, not seconds - C) Add the 2001 Apple epoch offset - D) Subtract 18 leap seconds

Q3. An Apple Watch health sample timestamp read naively as Unix time lands in 1992, but the data is clearly recent. The cause is that Apple stores Core Data / Mac absolute time as seconds since: - A) 1970-01-01 (the Unix epoch) - B) 1989-12-31 (the Garmin FIT epoch) - C) 2001-01-01 (add 978,307,200 to get Unix time) - D) 1601-01-01 (the Windows FILETIME epoch)

Q4. A Ring video doorbell is seized in a burglary case. Before building a theory on its footage, the first fact to confirm is: - A) The doorbell's firmware version - B) Whether the owner has an active Ring Protect subscription — without one, many Ring devices retain no recordings at all - C) The Wi-Fi password - D) The doorbell's serial number

Q5. Berla iVe is the dominant tool for extracting, from a vehicle: - A) The Event Data Recorder's pre-crash dynamics - B) The infotainment/telematics system — navigation tracklogs and the paired phones' names, MACs, contacts, and call logs cached in the head unit - C) Cloud telematics from the manufacturer - D) The tire-pressure sensors

Q6. The automotive Event Data Recorder ("black box"), read with the Bosch CDR tool and standardized in the U.S. by 49 CFR Part 563, primarily records: - A) A continuous trip log of everywhere the vehicle has driven - B) Roughly five seconds of pre-crash dynamics (speed, throttle, brake, delta-V, belt status) captured at a crash event - C) The contacts synced from a paired phone - D) The car's full GPS navigation history

Q7. When connecting a USB-TTL adapter to a device's UART pads, the pin you must not connect is: - A) GND - B) TX - C) RX - D) VCC — you only need TX/RX/GND, and feeding power can damage the device

Q8. On a small IoT device whose entire firmware lives on one 8-pin SPI NOR flash chip, the standard way to read it in-circuit is: - A) A JTAGulator and OpenOCD - B) A SOIC-8 test clip wired to an inexpensive programmer (e.g., CH341A), driven by flashrom - C) The Bosch CDR cable - D) Berla iVe

Q9. You dump a router's firmware and run binwalk. It reports a uImage header, LZMA data, and a Squashfs filesystem at offset 0x140000. To turn that blob into browsable evidence you next: - A) Upload it to VirusTotal - B) Carve and extract the file system (binwalk -e, then unsquashfs) and examine /etc/passwd, /etc/, keys, and /www - C) Re-flash it to the device - D) Treat the whole image as encrypted and stop

Q10. A Fitbit recorded step activity and a 96-bpm heart rate at 02:18. The most defensible statement an examiner can make is: - A) "The suspect was awake and moving at 02:18." - B) "The device on the victim's wrist recorded step activity and a 96-bpm heart rate at 02:18 (UTC, normalized)." - C) "The Fitbit proves the suspect was at the scene." - D) "The wearer was exercising at 02:18."

True/False

Q11. When a Ring owner has enabled end-to-end encryption, Amazon can still decrypt the clips and produce them in response to a warrant. (True / False)

Q12. Because Home Assistant records device state history into a local SQLite database (home-assistant_v2.db), you can acquire that history by imaging the hub it runs on, without serving legal process on any cloud provider. (True / False)

Short answer

Q13. In one or two sentences, explain the chapter's central operational shift — "the data you most want is often not on the device in your hand" — and name the legal instrument that typically stands between you and the cloud tier.

Q14. Name the three distinct data systems in a modern vehicle, and for each give the correct tool or authority used to obtain it.

---

Answer key

Q1 — C. Tier 3, the vendor cloud, is the "mother lode" (voice history, full video archive, health history, trip logs) and the hardest to reach, requiring the account owner's cooperation or compulsory legal process. Tier 1 holds the least of lasting value; Tier 2 (the app) is often the practical shortcut.

Q2 — B. The field is epoch milliseconds (note the 13 digits). Divide by 1,000 before treating it as Unix seconds; 1700000000.123 s is 2023-11-14 22:13:20 UTC. Forgetting this is a classic factor-of-1,000 error.

Q3 — C. Apple's databases use Mac absolute time — seconds since 2001-01-01 UTC. Add the 978,307,200-second offset to convert to Unix time; a value that reads as 1992 under the Unix epoch is actually 2023. Get it wrong and the timeline shifts by 31 years.

Q4 — B. Many Ring devices offer live view but retain no recordings without an active Ring Protect subscription; the video you want may never have existed past the moment it streamed. Always confirm subscription/retention status before relying on footage.

Q5 — B. iVe acquires and parses the head unit (IVI) — navigation history and tracklogs, vehicle events, and the paired-phone data the car cached (names, Bluetooth MACs, often contacts and call logs). The EDR (A) is read with Bosch CDR; cloud telematics (C) require legal process to the maker.

Q6 — B. The EDR is a crash recorder, not a trip logger: it buffers a few seconds of dynamics and captures that window when a crash/near-deployment event triggers it. Trip history lives in infotainment/telematics; the manufacturer's cloud holds the long-term location data.

Q7 — D. UART needs only TX, RX, and GND; VCC is device power, and connecting your adapter's power line (especially 5 V to a 3.3 V device) can damage the SoC. Confirm logic voltage before wiring.

Q8 — B. A Pomona-style SOIC-8 clip on the chip's legs, wired to a cheap programmer such as a CH341A and driven by flashrom, reads the NOR flash in-circuit. JTAGulator/OpenOCD (A) is for JTAG; Bosch CDR (C) and iVe (D) are vehicle tools.

Q9 — B. A firmware image is a blob until you carve it: binwalk -e extracts the file systems and unsquashfs unpacks SquashFS, after which the device's software is ordinary files — examine /etc/passwd and /etc/shadow, configuration and Wi-Fi keys in /etc/, embedded private keys, and the web UI under /www.

Q10 — B. State exactly what the device recorded, normalized to a defensible time reference — not who was wearing it or what they were doing. (A), (C), and (D) all leap from "the device recorded activity" to a claim about a person; that inference must be argued and corroborated, never asserted from the sensor alone.

Q11 — False. With Ring E2EE enabled, clips are encrypted with keys held only on the owner's enrolled mobile devices; Amazon cannot decrypt and produce them — the cloud analogue of the encryption wall met with phones. The lawful route then runs through the owner's enrolled device, not the provider.

Q12 — True. Home Assistant's recorder writes the full state/event history to a local database. Because it lives on hardware you can image (a Pi's SD card, a NAS, a mini-PC), you reach it with ordinary disk-imaging skills — no provider, no third-party warrant, and no retention timer but the one the owner configured.

Q13 — The operational shift. On most IoT devices the device itself holds little of lasting value; the rich record — voice history, full video, health and trip data — lives in the vendor's cloud (Tier 3). The instrument that typically stands between you and that data is a warrant (or subpoena for non-content records) served on the provider — i.e., your authority, not your technique, governs access. (Full credit also for naming the account owner's consent/credentials as the alternative path.)

Q14 — The three vehicle systems. (1) Infotainment/telematics (the head unit/IVI) — extracted with Berla iVe (and hardware-level flash reads where unsupported); (2) the Event Data Recorder — read with the Bosch CDR tool via OBD-II or directly at the airbag module, with owner consent or a warrant; (3) the connected-car cloud — obtained by legal process to the manufacturer. Full credit for the three systems each paired with a correct tool/authority.

Scoring: 13–14 — you can scope an Internet-of-Evidence case and keep its three tiers and three vehicle systems straight. 10–12 — solid; revisit the epoch traps (Q2, Q3) and the cloud/legal posture (Q1, Q11, Q13). 7–9 — re-read "The three tiers," "Vehicle forensics," and "Limitations." 6 or fewer — work the chapter again before any IoT case; the wrong assumption here loses evidence to a retention timer or loses a finding to cross-examination.