Certified Incident Handler (CIH) Practice Ecam

Which tool did John use to analyze activities on the victim's Android device during a security incident investigation?

1. ADB (Android Debug Bridge)

2. LogRabbit

3. Sysinternals Suite

4. Android Monitor

The correct answer is: LogRabbit

The accurate choice for analyzing activities on the victim's Android device during a security incident investigation is LogRabbit. This tool is specifically designed to capture and log events from Android devices, making it especially useful for forensic investigations. It allows investigators to gather data on application behavior, system events, and log entries, providing insight into the activities that occurred on the device. LogRabbit helps handle Android's unique architecture and data formats, providing a more reliable and effective method of obtaining logs directly from the device. Investigators can use this information to piece together the sequence of events leading up to and during the incident, assess the potential impact, and identify any malicious activity. While ADB (Android Debug Bridge) is a powerful tool for developers and can be utilized in investigations, it is more general and less tailored for forensic purposes compared to LogRabbit. Similarly, the Sysinternals Suite is excellent for Windows environments, and Android Monitor, while useful for debugging Android applications, does not focus specifically on capturing logs in a way that is beneficial for forensic purposes. Therefore, when analyzing activities on an Android device, LogRabbit offers a focused approach that aligns with the needs of a security incident investigation.