This scenario aligns with CHFI v11 objectives under Mobile and IoT Forensics and Cross-Platform Digital Evidence Correlation . Modern cyberattacks frequently involve multiple devices and operating systems working together as part of a single attack chain. In mobile forensic investigations, Android and iOS devices often store artifacts that reflect interactions with external systems such as Windows and Linux machines.
These artifacts may include USB connection logs, file transfer records, SSH keys, shared application data, cloud sync traces, or remnants of malware propagation.
CHFI v11 emphasizes the importance of event correlation and timeline analysis across heterogeneous environments. By analyzing Windows- and Linux-related files found on a mobile device, investigators can establish relationships between compromised endpoints, reconstruct attacker movement, and identify how data or malware was transferred between systems. This cross-device correlation is essential for attributing actions, understanding lateral movement, and proving coordinated activity during an incident.
The other options focus on device identification details, which are typically obtained through mobile hardware and OS artifacts, not through external system files. Therefore, the correct forensic purpose is to establish connections between multiple devices involved in the cyberattack, making option C the correct and CHFI-aligned answer.