Challenge LAB-0005

What a missing setting means

Report a setting that is not found as present, absent, unreadable or cannot say, and know why a missing key is not the same as a setting that is off.

Practitioner 30 to 45 minutesAndroid and iOS8 questions, 125 pointsAlways open, self-paced
Start the questionsRead the article first

The task

A person changes a privacy setting. The phone keeps the new state, and sometimes a record of the change, but usually not. You will learn to read a blank without turning it into an answer.

All challenge data is synthetic or comes from the Lab's published articles. No account is needed, nothing you type here leaves your browser except each answer you check, and the optional form if you send it.

What you need

Tools (all free)

  • A plain text editor
  • A calculator

Any tool that reads text will do. You do not need the Lab's own software or an account.

Questions

Each answer is checked when you press Check answer, and you see the result straight away. A wrong answer costs nothing, and you may try again. A hint lowers the points you can earn for that question: 2, 3 and 5 points for hints 1, 2 and 3, and a correct answer always earns at least 1 point. Checking needs JavaScript; reading does not.

  1. Question 1 of 815 points

    In how many of the 33 iPhone preference files that exist was the Lockdown Mode key present?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See Figure 2.

    Hint 2 costs 3 points

    The preference file was on 33 of 34 images.

    Hint 3 costs 5 points

    A small number, fewer than ten.

  2. Question 2 of 815 points

    A reader finds the preference file but not the Lockdown Mode key. What may you say?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See Table 1, the row Absent.

    Hint 2 costs 3 points

    Many keys are written only after a setting leaves its default.

    Hint 3 costs 5 points

    The key is absent; that is consistent with never changed.

  3. Question 3 of 820 points

    Select the four states the article says a reader's result should be sorted into.

    Select all that apply.

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See One blank, four meanings.

    Hint 2 costs 3 points

    Two of the six options are not states of a result but states of a setting.

    Hint 3 costs 5 points

    Present, absent, unreadable, cannot say.

  4. Question 4 of 815 points

    Of 45 iPhone security controls, how many left some trace in the unified log of the two decoded logs?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See Is there a record of the change?

    Hint 2 costs 3 points

    Fourteen left none.

    Hint 3 costs 5 points

    Thirty-something.

  5. Question 5 of 815 points

    USB debugging was on in all 14 Android full file system extractions. According to the article, why?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See When the evidence writes the value.

    Hint 2 costs 3 points

    Taking the evidence can set a value of its own.

    Hint 3 costs 5 points

    Acquisition over USB needs it.

  6. Question 6 of 815 points

    The iCloud Private Relay key was in how many of the 29 preference files that exist?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See the Private Relay row of the table under Figure 3.

    Hint 2 costs 3 points

    The article says what a missing key means here.

    Hint 3 costs 5 points

    Every one.

  7. Question 7 of 815 points

    A standard XML parser rejects an Android 12 settings file (Android Binary XML) and your reader returns an empty list. Which state should that result be reported as?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See Table 1, the row Unreadable.

    Hint 2 costs 3 points

    A source is in the evidence and was not read.

    Hint 3 costs 5 points

    Never turn a parse error into an empty list.

  8. Question 8 of 815 points

    How many of the 176 iOS restriction keys in Apple's schema are supervised-only?

    Need a hint?

    Three hints, in order. Each one lowers the points you can earn for this question.

    Hint 1 costs 2 points

    See the passcode and restriction policy row.

    Hint 2 costs 3 points

    On a personal iPhone these are reported as not applicable.

    Hint 3 costs 5 points

    More than two thirds of the 176.

You have finished: what you should have learned

  • A setting leaves a state record, which the next change overwrites. A record of the change is a separate thing, and for most settings there is none.
  • A missing key is not off. Many keys are written only after a setting leaves its default, and a blank has at least four causes.
  • Say which of four states a result is in. Only the first, present, is a statement about the setting.
  • The evidence can write the value. Check what acquisition itself sets, such as USB debugging.
Next challenge by number: Link records across storesSee your progress mapRead the article again

Completion note

Typed here only. It appears on the printed note and is not saved or sent anywhere.

UpDownto moveEnterto openEscto close