QuestionQ19

Enterprise Environment Incident Response

Adam is a professional Computer Hacking Forensic Investigator. The chief security officer of a cloth manufacturing company assigns him a project after suspecting that an employee is selling the company’s clothing designs outside the organization. The security officer asks Adam to investigate the employee’s iPhone because sensitive information might be stored on it.

During the investigation, Adam discovers that the employee is attempting to destroy evidence on the iPhone. The employee presses and holds the Home and Power buttons until the device is forced into recovery mode. Which of the following occurs when an iPhone is placed into recovery mode?

  • A iPhone will be prevented from booting temporarily.
  • B The file system will be destroyed.
  • C Nothing will happen.
  • D Data will be destroyed.
Explanation

Recovery mode prevents a normal iOS startup and places the device in a state where a connected computer can update or restore it. Recovery mode alone does not erase data; data is erased only when the Restore action is selected.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!