CHFI Mobile and Malware Forensics Practice Test 1 — 15 Questions

Question 1

During a mobile forensics investigation, an analyst needs to acquire data from an iPhone that cannot be bypassed via passcode. The device is locked, and the analyst has the passcode. Which acquisition method provides the MOST comprehensive data extraction?

Accepted Answer

Physical acquisition. Physical acquisition is the most comprehensive method because it creates a bit-for-bit copy of the entire flash storage, including the operating system, kernel, unallocated space, and deleted file remnants. Even with the passcode known, a locked iPhone restricts file system access via USB, but physical acquisition (often using advanced techniques like JTAG or chip-off) bypasses these restrictions to extract the raw NAND data, yielding the fullest forensic picture.

Answer

Manual acquisition

Answer

Logical acquisition

Answer

File system acquisition

Question 2

A security analyst is reviewing output from a Cuckoo Sandbox analysis of a suspicious executable. The report shows that the process created a mutex named 'Global\GLOBAL_MUTEX_123' and modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\. Which behavioral indicator is MOST evident?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Answer

Command and control communication

Answer

Anti-debugging technique

Answer

Privilege escalation

Question 3

In an Android forensic investigation, an examiner extracts the /data/data/com.whatsapp/databases/msgstore.db file. The database contains a table 'messages' with columns 'key_remote_jid', 'data', and 'timestamp'. Which SQL query would retrieve all messages sent to a specific contact with a phone number ending in '1234'?

Accepted Answer

SELECT * FROM messages WHERE key_remote_jid LIKE '%1234%'. Option B is correct because the `key_remote_jid` column stores the remote party's identifier (e.g., a phone number with country code), and the `LIKE '%1234%'` pattern matches any value containing '1234' anywhere in the string. This retrieves all messages where the contact's phone number ends with '1234', as required by the question.

Answer

SELECT * FROM messages WHERE key_remote_jid = '%1234%'

Answer

SELECT * FROM messages WHERE data LIKE '%1234%'

Answer

SELECT * FROM messages WHERE timestamp LIKE '%1234%'

Question 4

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Accepted Answer

PEiD. PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Answer

Strings

Answer

Ghidra

Answer

IDA Pro

Question 5

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Accepted Answer

Notes app data. The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.

Answer

Call history

Answer

SMS and iMessage conversations

Answer

Keychain data

Question 6

A forensic examiner is analyzing an Android device that has been factory reset. Which artefact is MOST likely to persist after a factory reset, providing potential evidence of prior usage?

Accepted Answer

Google account artefacts. Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, are stored in the /data/system/ partition and are often retained even after a factory reset because the reset does not always wipe the cryptographic keys or the persistent data blocks used by Google's sync services. This allows forensic tools to recover the previously synced account details, providing evidence of prior usage.

Answer

App installation logs

Answer

Deleted SMS messages

Answer

Wi-Fi passwords

Question 7

An analyst runs 'regshot' before and after executing a suspicious binary. The report shows that the binary added a value to HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to C:\Windows\system32\malware.exe and 'Start' set to 2. What is the MOST likely purpose?

Accepted Answer

Persistence as a service. The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

Answer

Hiding network connections

Answer

Encrypting files

Answer

Disabling a legitimate service

Question 8

A malware analyst uses Cuckoo Sandbox to analyze a sample. The report shows that the sample sends HTTP POST requests to 'http://malicious.example.com/gate.php' with encrypted data. Which type of indicator of compromise (IoC) is this?

Accepted Answer

Network-based IoC. The HTTP POST request to a remote URL with encrypted data is a classic network-based indicator because it involves communication over a network protocol (HTTP) to an external server. Cuckoo Sandbox captures this as a network artifact, making it a network-based IoC (Option D). Host-based IoCs focus on file system or registry changes, memory-based on in-RAM artifacts, and hash-based on file fingerprints.

Answer

Host-based IoC

Answer

Memory-based IoC

Answer

Hash-based IoC

Question 9

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Accepted Answer

GrayKey. GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

Cellebrite UFED

Question 10

During dynamic analysis of a malware sample, an analyst uses Process Monitor to capture registry and file system activity. Which filter would be MOST effective in identifying attempts to create a persistence mechanism?

Accepted Answer

Filter for 'RegSetValue' events with path containing 'CurrentVersion\Run'. The 'CurrentVersion\Run' registry key is a standard persistence location where malware adds entries to execute automatically at user logon. Filtering for 'RegSetValue' events targeting this path directly captures the act of writing a new value to that key, which is a common persistence mechanism. Process Monitor's 'RegSetValue' operation specifically monitors registry value modifications, making it the most effective filter for this purpose.

Answer

Filter for 'WriteFile' events in System32

Answer

Filter for 'Process Create' events

Answer

Filter for 'RegSetValue' events with path containing 'RunOnce'

Question 11

An iOS forensic analyst extracts the Keychain from an iTunes backup. Within the Keychain, they find an entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud'. What type of data does this entry MOST likely contain?

Accepted Answer

iCloud credentials. The entry with class 'Generic Password', service 'com.apple.sbd', and account 'iCloud' corresponds to the iCloud credentials stored in the iOS Keychain. The service identifier 'com.apple.sbd' is the bundle ID for Apple's 'sbd' daemon, which handles iCloud syncing and authentication. This Keychain entry stores the user's iCloud account password, not a Wi-Fi password, device passcode, or SMS encryption key.

Answer

Wi-Fi password

Answer

Device passcode

Answer

SMS encryption key

Question 12

A security analyst detects that a system's 'SeDebugPrivilege' is enabled for a suspicious process. Which technique is the malware MOST likely attempting to use?

Accepted Answer

Process injection. SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

Answer

Persistence through service

Answer

Anti-debugging

Answer

Network sniffing

Question 13

A forensic examiner is analyzing a mobile device that may have been tampered with to erase evidence. Which TWO anti-forensic techniques are commonly encountered in mobile forensics? (Select TWO.)

Accepted Answer

Factory reset. Factory reset (option C) is a common anti-forensic technique in mobile forensics because it wipes user data partitions and resets the device to its original state, often using the 'wipe_data' command in recovery mode or via settings. This removes user-installed applications, accounts, and files, making data recovery difficult unless a physical or chip-off method is used. Timestomping (option E) is also common, as attackers modify file timestamps (e.g., using 'touch -t' on rooted devices or manipulating EXT4 metadata) to mislead forensic timelines and hide the sequence of events.

Answer

Encryption

Answer

Steganography

Answer

Log wiping

Question 14

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Option B is correct because performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 15

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)