CHFI Mobile and Malware Forensics — 40 Questions

Question 1

During a mobile forensics investigation, an analyst needs to acquire data from an iPhone that cannot be bypassed via passcode. The device is locked, and the analyst has the passcode. Which acquisition method provides the MOST comprehensive data extraction?

Accepted Answer

Physical acquisition. Physical acquisition is the most comprehensive method because it creates a bit-for-bit copy of the entire flash storage, including the operating system, kernel, unallocated space, and deleted file remnants. Even with the passcode known, a locked iPhone restricts file system access via USB, but physical acquisition (often using advanced techniques like JTAG or chip-off) bypasses these restrictions to extract the raw NAND data, yielding the fullest forensic picture.

Answer

Manual acquisition

Answer

Logical acquisition

Answer

File system acquisition

Question 2

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 3

In an Android forensic investigation, an examiner extracts the /data/data/com.whatsapp/databases/msgstore.db file. The database contains a table 'messages' with columns 'key_remote_jid', 'data', and 'timestamp'. Which SQL query would retrieve all messages sent to a specific contact with a phone number ending in '1234'?

Accepted Answer

SELECT * FROM messages WHERE key_remote_jid LIKE '%1234%'. Option B is correct because the `key_remote_jid` column stores the remote party's identifier (e.g., a phone number with country code), and the `LIKE '%1234%'` pattern matches any value containing '1234' anywhere in the string. This retrieves all messages where the contact's phone number ends with '1234', as required by the question.

Answer

SELECT * FROM messages WHERE key_remote_jid = '%1234%'

Answer

SELECT * FROM messages WHERE data LIKE '%1234%'

Answer

SELECT * FROM messages WHERE timestamp LIKE '%1234%'

Question 4

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Accepted Answer

PEiD. PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Answer

Strings

Answer

Ghidra

Answer

IDA Pro

Question 5

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Accepted Answer

Notes app data. The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.

Answer

Call history

Answer

SMS and iMessage conversations

Answer

Keychain data

Question 6

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, are stored in the /data/system/ partition and are often retained even after a factory reset because the reset does not always wipe the cryptographic keys or the persistent data blocks used by Google's sync services. This allows forensic tools to recover the previously synced account details, providing evidence of prior usage.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 7

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 8

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 9

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Accepted Answer

GrayKey. GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

Cellebrite UFED

Question 10

During dynamic analysis of a malware sample, an analyst uses Process Monitor to capture registry and file system activity. Which filter would be MOST effective in identifying attempts to create a persistence mechanism?

Accepted Answer

Filter for 'RegSetValue' events with path containing 'CurrentVersion\Run'. The 'CurrentVersion\Run' registry key is a standard persistence location where malware adds entries to execute automatically at user logon. Filtering for 'RegSetValue' events targeting this path directly captures the act of writing a new value to that key, which is a common persistence mechanism. Process Monitor's 'RegSetValue' operation specifically monitors registry value modifications, making it the most effective filter for this purpose.

Answer

Filter for 'WriteFile' events in System32

Answer

Filter for 'Process Create' events

Answer

Filter for 'RegSetValue' events with path containing 'RunOnce'

Question 11

An iOS forensic analyst extracts the Keychain from an iTunes backup. Within the Keychain, they find an entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud'. What type of data does this entry MOST likely contain?

Accepted Answer

iCloud credentials. The entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud' corresponds to the iCloud credentials stored in the iOS Keychain. The service identifier 'com.apple.sbd' is the bundle ID for Apple's 'sbd' daemon, which handles iCloud syncing and authentication. This Keychain entry stores the user's iCloud account password, not a Wi-Fi password, device passcode, or SMS encryption key.

Answer

Wi-Fi password

Answer

Device passcode

Answer

SMS encryption key

Question 12

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Accepted Answer

Process injection. SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

Answer

Persistence through service

Answer

Anti-debugging

Answer

Network sniffing

Question 13

A forensic examiner is analyzing a mobile device that may have been tampered with to erase evidence. Which TWO anti-forensic techniques are commonly encountered in mobile forensics? (Select TWO.)

Accepted Answer

Factory reset. Factory reset (option C) is a common anti-forensic technique in mobile forensics because it wipes user data partitions and resets the device to its original state, often using the 'wipe_data' command in recovery mode or via settings. This removes user-installed applications, accounts, and files, making data recovery difficult unless a physical or chip-off method is used. Timestomping (option E) is also common, as attackers modify file timestamps (e.g., using 'touch -t' on rooted devices or manipulating EXT4 metadata) to mislead forensic timelines and hide the sequence of events.

Answer

Encryption

Answer

Steganography

Answer

Log wiping

Question 14

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Option B is correct because performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 15

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)

Question 16

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 17

A security analyst runs a dynamic analysis of a suspected malware sample using Cuckoo Sandbox. The report shows that the sample created a mutex named 'Global\MyMaliciousMutex', added a registry run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and attempted to communicate with an IP address 185.10.68.12 on port 443. Which of the following is the BEST immediate indicator of compromise (IoC) to share with the threat intelligence team?

Accepted Answer

The IP address 185.10.68.12. The network C2 IP address is direct and actionable for blocklisting. Registry keys and mutex names can be used for detection but are less definitive for network defense.

Answer

The registry run key location

Answer

The sample's MD5 hash

Answer

The mutex name 'Global\MyMaliciousMutex'

Question 18

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Accepted Answer

Physical extraction using a JTAG or chip-off technique. Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Answer

Manual extraction through the user interface

Answer

Logical extraction via ADB

Answer

File system extraction

Question 19

During a malware analysis session, an analyst uses Process Monitor (Procmon) to observe a suspicious executable. Which of the following behavioral indicators would MOST strongly suggest the malware is attempting to establish persistence?

Accepted Answer

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Answer

Making outbound TCP connections to an IP address

Answer

Creating a named mutex

Answer

Creating files in the %TEMP% directory

Question 20

An iOS forensic analyst is examining data from an iCloud backup and finds a file named 'call_history.db'. Which SQLite table within this database is MOST likely to contain the duration and timestamp of each phone call?

Accepted Answer

call. In iOS, call history data is stored in the 'call_history.db' SQLite database, and the primary table containing call duration and timestamps is named 'call'. The 'call' table includes columns such as 'duration' (in seconds) and 'date' (as a Cocoa Core Data timestamp). This is the standard schema used by Apple's Phone app since iOS 4.

Answer

ZCONTACT

Answer

ZOBJECT

Answer

ZCALL