According to the CHFI v11 objectives underMobile and IoT Forensics, understanding theiOS architecture stackis essential for both application analysis and forensic investigations. The iOS architecture is divided into four primary layers: Cocoa Touch, Media Services, Core Services, and Core OS. Each layer provides specific frameworks and capabilities.
In this scenario, Alice is working withOpenGL ES,OpenAL, andAV Foundation, which are all core frameworks associated withgraphics rendering, audio processing, and multimedia handling. These technologies reside in theMedia Services Layer, making Option D the correct answer. The Media Services layer is responsible for supporting 2D/3D graphics, audio, video playback, and media capture—critical components for immersive gaming and multimedia applications.
The Cocoa Touch layer (Option A) focuses on user interface elements and application-level interactions. The Core Services layer (Option C) provides foundational services such as data persistence, networking, and location services. The Core OS layer (Option B) operates closest to the hardware, handling memory management, security, and low-level system operations. None of these layers directly provide the multimedia frameworks highlighted in the scenario.
CHFI v11 explicitly includesiOS architecture and boot processas part of mobile forensics, emphasizing the Media Services layer as the source of multimedia frameworks commonly examined during application and malware analysis on iOS devices
