CHFI Mobile and Malware Forensics Practice Test 10 — 15 Questions

Question 1

During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.

Answer

Manual acquisition by taking screenshots

Answer

File system acquisition via iOS file system extraction

Answer

Logical acquisition via iTunes backup

Question 2

An Android device is seized as evidence. The screen is locked with a PIN. Which tool or method is MOST appropriate for acquiring a physical image of the device without bypassing the lock screen, assuming the device is rooted?

Accepted Answer

Boot into recovery mode and use ADB to dd the userdata partition. Option A is correct because booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.

Answer

Use Cellebrite UFED with a lock screen bypass exploit

Answer

Remove the microSD card and image it separately

Answer

Perform an ADB backup to obtain app data only

Question 3

A security analyst observes a suspicious process creating multiple mutexes with names like 'XxX_12345' and 'XxX_67890' and making outbound connections to an IP address 185.130.5.1 on port 443. Which behavioral indicator is MOST consistent with malware communication?

Accepted Answer

The mutexes indicate an attempt to prevent multiple instances, and outbound connections suggest C2 activity. The creation of mutexes with a consistent naming pattern (e.g., 'XxX_12345') is a classic anti-replication mechanism used by malware to ensure only one instance runs on a system, preventing conflicts and detection. The outbound connections to a specific IP on port 443 (HTTPS) are highly indicative of command-and-control (C2) communication, as malware often uses encrypted channels to blend in with legitimate traffic. Option C correctly identifies both the mutex's purpose (preventing multiple instances) and the network behavior (C2 activity), making it the most consistent with malware communication.

Answer

The process is performing data exfiltration via DNS tunneling

Answer

The process is attempting to spread to other machines via SMB

Answer

The process is a legitimate application using mutexes for inter-process communication

Question 4

In malware static analysis, a PE file is examined. The section names include '.text', '.rdata', '.data', and '.rsrc'. The entry point is in the .text section. Which tool would be MOST appropriate to identify any packer that might be obfuscating the code?

Accepted Answer

PEiD. PEiD is specifically designed to detect packers, cryptors, and compilers by scanning PE files for known signatures in the entry point and section headers. Since the question asks for identifying a packer that obfuscates code, PEiD's signature-based detection directly targets this need, unlike general-purpose disassemblers or string extractors.

Answer

strings

Answer

Ghidra

Answer

IDA Pro

Question 5

During an iOS forensics investigation, an examiner wants to extract call history records from an iPhone backup. Which SQLite database file should be examined?

Accepted Answer

call_history.db. In iOS forensics, call history records are stored in the SQLite database file named 'call_history.db' (or 'CallHistory.storedata' in newer iOS versions). This database contains tables such as 'call' and 'ZCALLRECORD' that log incoming, outgoing, and missed calls along with timestamps and durations. Examining this file directly from an iTunes backup or device extraction provides the examiner with the complete call log.

Answer

SMS.db

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Question 6

A forensic analyst is examining an Android device and wants to recover Google account artefacts, such as the last sync timestamp and cached email addresses. Where on the device (in /data/data/) would these artefacts MOST likely be stored?

Accepted Answer

com.google.android.gms. The Google account artefacts, including the last sync timestamp and cached email addresses, are stored within the package 'com.google.android.gms' (Google Play Services). This package manages authentication tokens, sync settings, and account metadata in its databases (e.g., 'accounts.db' or 'gms_credentials.db') under /data/data/com.google.android.gms/databases/. The last sync timestamp is typically recorded in the 'sync_state' table, while cached email addresses appear in the 'accounts' table.

Answer

com.android.providers.telephony

Answer

com.android.providers.contacts

Answer

com.android.settings

Question 7

During dynamic analysis of a suspicious executable in Cuckoo Sandbox, the report shows that the process created a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'WindowsUpdate' and dropped a file 'svchost.exe' in %AppData%. Which conclusion is MOST consistent with these indicators?

Accepted Answer

The executable is attempting to establish persistence via a Run key and masquerading as a system process. The creation of a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism that causes the executable to launch automatically at user logon. Dropping a file named 'svchost.exe' in %AppData% is a common masquerading technique, as the legitimate svchost.exe (Service Host) resides in C:\Windows\System32, not in the user's AppData folder. Together, these actions indicate the executable is establishing persistence and disguising itself as a trusted system process.

Answer

The executable is cleaning up after itself by deleting temporary files

Answer

The executable is a dropper that installs a rootkit

Answer

The executable is a legitimate Windows update component

Question 8

An incident responder finds a file named 'photo.jpg' on a compromised system. The file size is 2 MB and it is located in a temp directory. The file's SHA256 hash is 5d41402abc4b2a76b9719d911017c592. What is the BEST next step to determine if this file is malicious?

Accepted Answer

Compare the hash against known malware hashes in a threat intelligence database. Option C is correct because comparing the SHA256 hash of the file against a threat intelligence database (e.g., VirusTotal, AlienVault OTX) is the fastest, least intrusive method to determine if the file is known malware. Since the file is 2 MB and located in a temp directory, it could be a legitimate image or a disguised executable; hash comparison leverages existing threat intelligence without altering the evidence or risking system compromise.

Answer

Delete the file to prevent potential harm

Answer

Perform static analysis using IDA Pro to disassemble the file

Answer

Run the file in a sandbox environment to observe behavior

Question 9

Which mobile forensic tool is specifically designed to extract data from a wide range of mobile devices, including both iOS and Android, and is commonly used by law enforcement agencies?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is the correct answer because it is a dedicated hardware and software solution specifically engineered to extract data from a vast array of mobile devices, including iOS and Android, through both physical and logical acquisition methods. It is widely adopted by law enforcement agencies globally due to its ability to bypass lock screen security, support over 30,000 device profiles, and extract deleted data via advanced techniques like JTAG and chip-off.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager

Question 10

During an iOS forensic analysis, an examiner recovers the Keychain data from a backup. Which type of information is commonly stored in the iOS Keychain and can be extracted during analysis?

Accepted Answer

Wi-Fi passwords and website login credentials. The iOS Keychain is a secure, encrypted database designed to store sensitive user credentials and secrets. Wi-Fi passwords and website login credentials are explicitly stored in the Keychain to protect them from unauthorized access, making them recoverable during forensic analysis of a backup.

Answer

Text message content and attachments

Answer

Call log timestamps and durations

Answer

Contact photos and thumbnails

Question 11

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

Accepted Answer

User data such as photos and contacts. After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Answer

The GUID Partition Table (GPT)

Answer

The device's encryption keys

Answer

The Android OS system files

Question 12

A malware analyst is using a tool to monitor registry and file system changes during the execution of a suspicious binary. Which tool is specifically designed to take snapshots of the registry and file system before and after execution to identify changes?

Accepted Answer

Regshot. Regshot is a lightweight open-source tool designed specifically to compare registry hives and file system snapshots taken before and after executing a binary. It generates a detailed report of added, modified, or deleted keys and files, making it ideal for malware analysis to quickly identify persistence mechanisms or configuration changes.

Answer

Cuckoo Sandbox

Answer

Process Explorer

Answer

Process Monitor

Question 13

A forensic examiner is analyzing an Android device and needs to extract application data from the /data/data/ directory. Which TWO conditions must be met to access this directory? (Select TWO.)

Accepted Answer

USB debugging must be enabled. The /data/data/ directory on Android contains application private data, which is protected by Linux user permissions (UID/GID) and SELinux policies. USB debugging must be enabled (Option A) to allow the forensic workstation to communicate with the device via ADB (Android Debug Bridge) for command execution. The device must be rooted (Option B) because the /data/data/ directory is owned by the system and individual app UIDs, and only a root user (UID 0) can bypass these permissions to read all application data.

Answer

The device must be in recovery mode

Answer

The bootloader must be unlocked

Answer

The screen must be unlocked

Question 14

During dynamic analysis of a suspected malware sample, an analyst observes the following behaviors: (1) The process creates a service named 'WindowsDefender' that starts automatically. (2) It writes an encrypted payload to the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. (3) It injects code into explorer.exe. (4) It attempts to resolve the domain 'malware-update.com'. (5) It creates a mutex named 'Global\MyMutex'. Which THREE behaviors are indicators of malware persistence? (Select THREE.)

Accepted Answer

Injecting code into explorer.exe. Injecting code into explorer.exe (option A) is a persistence mechanism because the injected code runs within the context of a trusted system process that starts automatically at user logon. By hijacking explorer.exe, the malware ensures its malicious code executes every time the user logs into the system, surviving a reboot without needing a separate startup entry.

Answer

Creating a mutex named 'Global\MyMutex'

Answer

Attempting to resolve the domain 'malware-update.com'

Question 15

A malware analyst is performing static analysis on a suspicious PE file. Which TWO of the following are examples of anti-forensic techniques that the malware might use to hinder analysis? (Select TWO.)

Accepted Answer

Packing or obfuscating the malicious code. Packing or obfuscating the malicious code (Option B) is a classic anti-forensic technique used to hinder static analysis. Packers compress or encrypt the original PE file's code and data, making it unreadable to disassemblers and signature-based scanners until the unpacking stub executes at runtime. This forces the analyst to perform dynamic analysis or manual unpacking, significantly increasing the time and complexity of the investigation.

Answer

Using TLS encryption for network communication

Answer

Creating registry keys for persistence

Answer

Writing temporary files to the %TEMP% directory