CHFI Mobile and Malware Forensics Practice Test 11 — 15 Questions

Question 1

During an iOS forensic analysis, an examiner recovers the Keychain data from a backup. Which type of information is commonly stored in the iOS Keychain and can be extracted during analysis?

Accepted Answer

Wi-Fi passwords and website login credentials. The iOS Keychain is a secure, encrypted database designed to store sensitive user credentials and secrets. Wi-Fi passwords and website login credentials are explicitly stored in the Keychain to protect them from unauthorized access, making them recoverable during forensic analysis of a backup.

Answer

Text message content and attachments

Answer

Call log timestamps and durations

Answer

Contact photos and thumbnails

Question 2

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

Accepted Answer

User data such as photos and contacts. After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Answer

The GUID Partition Table (GPT)

Answer

The device's encryption keys

Answer

The Android OS system files

Question 3

A malware analyst is using a tool to monitor registry and file system changes during the execution of a suspicious binary. Which tool is specifically designed to take snapshots of the registry and file system before and after execution to identify changes?

Accepted Answer

Regshot. Regshot is a lightweight open-source tool designed specifically to compare registry hives and file system snapshots taken before and after executing a binary. It generates a detailed report of added, modified, or deleted keys and files, making it ideal for malware analysis to quickly identify persistence mechanisms or configuration changes.

Answer

Cuckoo Sandbox

Answer

Process Explorer

Answer

Process Monitor

Question 4

A malware analyst is performing static analysis on a suspicious PE file. Which TWO of the following are examples of anti-forensic techniques that the malware might use to hinder analysis? (Select TWO.)

Accepted Answer

Packing or obfuscating the malicious code. Option B is correct because packing or obfuscating the malicious code (e.g., with UPX, Themida, or custom crypter) hides the true code and strings from static analysis tools, forcing the analyst to unpack or emulate before meaningful inspection is possible. Option E is correct because timestomping deliberately alters a file's $STANDARD_INFORMATION and/or $FILE_NAME timestamps (creation, modification, access, MFT entry change) to mislead investigators about when the malware was placed or executed, which is a classic anti-forensic technique. Option A is not an anti-forensic technique against static analysis; TLS is simply an encrypted transport that hinders network traffic inspection, not examination of the PE file itself. Option C is a persistence mechanism (e.g., Run keys, Services), not an anti-forensic measure. Option D is normal runtime behavior for many programs and does not specifically hinder static analysis of the PE file.

Answer

Using TLS encryption for network communication

Answer

Creating registry keys for persistence

Answer

Writing temporary files to the %TEMP% directory

Question 5

During a mobile forensic investigation, an examiner finds that the seized iPhone is locked with a passcode but is running iOS 11. Which acquisition method should the examiner prioritize to obtain the most data without bypassing the passcode?

Accepted Answer

Logical acquisition via iTunes backup. For a locked iPhone running iOS 11, physical and file system acquisitions are typically blocked by hardware encryption and the Secure Enclave unless the passcode is bypassed. However, if the device has been previously trusted with a computer, a logical acquisition via iTunes backup can be performed without entering the passcode, as the trust relationship authorizes the backup. This method extracts the most data (contacts, messages, photos, etc.) without bypassing the passcode. If no trust relationship exists, logical acquisition is not possible without the passcode, but the CHFI exam often assumes a previously trusted computer for this scenario.

Answer

Physical acquisition using a JTAG tool

Answer

File system acquisition using Cellebrite UFED

Answer

Manual acquisition by photographing the screen

Question 6

An analyst suspects a Windows executable is packed. They run `strings` on the file and see few readable strings, and PEiD reports 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. Which static analysis technique should the analyst use NEXT to extract the original code?

Accepted Answer

Use UPX with the -d flag to decompress the executable. UPX (Ultimate Packer for Executables) is a common packer that compresses Windows executables. The PEiD output 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX. Running `upx -d` (decompress) reverses the packing, restoring the original executable code for static analysis. This is the standard next step before attempting disassembly or dynamic analysis.

Answer

Search for known YARA rules matching UPX

Answer

Run the executable in Cuckoo Sandbox to obtain dynamic analysis

Answer

Load the file into IDA Pro and attempt to disassemble directly

Question 7

A forensic examiner is analyzing an Android device that was factory reset. Which TWO artefacts or methods could the examiner use to potentially recover or identify data from before the reset?

Accepted Answer

Analyzing Google account artefacts synced to the cloud. Option D is correct because data synced to the user's Google account (e.g., Gmail, Contacts, Calendar, Drive, Photos, and Android backups) resides in Google's cloud infrastructure and is not erased by a local factory reset, so the examiner can obtain pre-reset artefacts via the account or legal process. Option E is correct because a physical extraction tool such as Cellebrite UFED reads the underlying flash memory (often via ISP, JTAG, or chip-off) and can recover residual data, including remnants in unallocated space that survive a factory reset if not securely wiped. Option A does not belong because ADB logical extraction only exposes data accessible to the running OS or a debug-enabled device, and a factory reset removes user data and typically disables USB debugging. Option B does not belong because ADB backup cannot recover deleted apps and requires debugging authorization that a reset device will not grant. Option C does not belong because manual UI examination only shows the post-reset state and cannot surface pre-reset data.

Answer

Performing a logical extraction via ADB

Answer

Recovering deleted apps via ADB backup

Answer

Examining the device manually through the UI

Question 8

An analyst is performing dynamic analysis of a malware sample in Cuckoo Sandbox. Which TWO of the following are typical indicators of command and control (C2) communication?

Accepted Answer

The malware performs DNS queries to a domain that resolves to a known malicious IP. Option B is correct because DNS queries to a domain resolving to a known malicious IP are a classic C2 indicator: the malware must locate its controller, and threat-intel feeds flag such resolutions as beaconing to adversary infrastructure. Option E is correct because HTTP POST requests to a newly registered domain (2 days old) fit the C2 profile of exfiltrating victim data or receiving tasking over web protocols, and domain age is a strong reputation signal for malicious infrastructure. Option A is not a C2 indicator but a persistence technique via the Registry Run key. Option C describes system file modification, which indicates tampering or defense evasion rather than network C2. Option D describes mutex creation, which is typically used for single-instance checks or host-based sandbox-evasion markers, not command-and-control traffic.

Answer

The malware creates a registry run key for persistence

Answer

The malware modifies system files in C:\Windows\System32

Answer

The malware creates a mutex named 'Global\MyMutex'

Question 9

During an iOS forensics investigation, an examiner extracts an iTunes backup and finds the SQLite database files. Which TWO of the following databases are LEAST likely to contain forensically relevant artefacts for a communication analysis?

Accepted Answer

data_ark.db. B is correct because data_ark.db is not a standard iOS SQLite database; it does not exist in typical iOS backups or file systems. The name suggests a fabricated or non-standard artefact, making it least likely to contain forensically relevant communication data. In contrast, databases like SMS.db and call_history.db are well-documented repositories for SMS messages and call logs, respectively.

Answer

SMS.db

Answer

AddressBook.db

Answer

call_history.db

Question 10

A security team is investigating a suspected Advanced Persistent Threat (APT) intrusion. They have identified several IoCs. Which THREE of the following are considered standard types of Indicators of Compromise?

Accepted Answer

IP address of a command and control server. Option B is correct because the IP address of a command and control (C2) server is a classic network-based IoC that defenders use to detect beaconing or outbound connections to attacker infrastructure. Option C is correct because an MD5 hash of a malicious executable is a file-based (hash) IoC that uniquely identifies known malware samples and enables blocklisting or scanning. Option D is correct because a registry key path used for persistence is a host-based IoC, since attackers commonly abuse Run keys, Services, or similar registry locations to survive reboots. Option A is not a standard IoC type because employee badge numbers are identity/HR data, not technical artifacts of compromise. Option E is not a standard IoC type because an email subject line is contextual phishing content, not a reliable technical indicator such as a hash, IP, domain, URL, or registry artifact.

Answer

Employee badge number

Answer

Email subject line from a phishing campaign

Question 11

A forensic analyst is performing static analysis of a Windows PE file. Which TWO of the following tools are specifically designed for static analysis of malware?

Accepted Answer

IDA Pro. IDA Pro (C) is a disassembler and debugger specifically built for reverse engineering binary executables, allowing an analyst to statically examine a PE file's code, imports, and structure without executing it. Ghidra (D) is the NSA's open-source software reverse engineering suite that likewise performs static disassembly and decompilation of PE files, making it a core static malware analysis tool. Both operate on the file on disk, matching the scenario's requirement for static analysis. Wireshark (A) is a network protocol analyzer that inspects captured traffic, not PE binaries. Cuckoo Sandbox (B) is a dynamic analysis platform that executes malware in an isolated VM and observes behavior, so it is not static. Process Monitor (E) is a live runtime monitoring tool for file, registry, and process activity, also dynamic rather than static.

Answer

Wireshark

Answer

Cuckoo Sandbox

Answer

Process Monitor

Question 12

A forensic examiner is analyzing an Android device for potential evidence of a specific app’s data. Which TWO locations within the device’s file system would MOST likely contain application-specific data?

Accepted Answer

/data/data//. Option A, /data/data//, is correct because this is the primary internal storage location where an Android app's private data—such as SQLite databases, shared_preferences XML files, and cached files—is stored under its package name, accessible only with root or a forensic image. Option D, /sdcard/Android/data//, is correct because it is the app-specific external storage directory (on the emulated /sdcard partition) where apps commonly place user-generated files, downloads, and caches that are often recoverable without root. Option B, /recovery/, is not app-specific data; it holds the recovery partition image used for system recovery and OTA updates. Option C, / (root directory), is the top-level filesystem hierarchy containing system directories, not a location for a particular app's data. Option E, /system/app/, contains pre-installed system APK files, not the runtime data generated by a specific application.

Answer

/recovery/

Answer

/ (root directory)

Answer

/system/app/

Question 13

Which TWO of the following are primary purposes of using the GrayKey tool in iOS forensics?

Accepted Answer

Extract the full file system from a locked iOS device. Option C is correct because GrayKey is a hardware-based forensic tool designed to perform full file system extractions from iOS devices, including locked ones, providing investigators with a complete image of the device's data rather than just a logical backup. Option D is correct because a core function of GrayKey is passcode bypass — it uses brute-force and exploit techniques to defeat the iOS lock screen passcode, which is the prerequisite that enables the full file system extraction in option C. Options A and B are incorrect because GrayKey is not a static malware analysis platform nor a binary decryption tool; those tasks are handled by disassemblers and reverse-engineering suites such as IDA Pro, Ghidra, or Hopper. Option E is incorrect because GrayKey does not create encrypted iTunes backups — that is the function of iTunes/Finder or libimobiledevice, and GrayKey's purpose is direct device extraction, not backup generation.

Answer

Perform static analysis of iOS malware

Answer

Decrypt iOS application binaries for analysis

Answer

Create an encrypted iTunes backup

Question 14

A security analyst observes a process making repeated network connections to an IP address 192.168.1.100 on TCP port 4444, and the process writes a DLL file to C:\Users\Public\. Which THREE actions should the analyst take immediately as part of dynamic analysis?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. Option A is correct because the repeated TCP connections to 192.168.1.100 on port 4444 strongly indicate command-and-control (C2) traffic, and isolating the host from the network immediately contains the incident and prevents further data exfiltration or remote instructions. Option B is correct because capturing a memory dump with FTK Imager (or an equivalent tool like WinPmem or DumpIt) preserves volatile evidence such as injected code, running processes, network connections, and encryption keys that would be lost on shutdown or reboot. Option D is correct because Process Monitor (Procmon) provides real-time visibility into process creation, file system writes (such as the DLL dropped in C:\Users\Public\), registry changes, and network activity, which is essential for dynamic analysis of the malware's behavior. Option C is not appropriate because deleting the DLL destroys forensic evidence and may not stop the running process, which could simply re-drop the file; the analyst should preserve and analyze it first. Option E is not appropriate at this stage because reimaging the hard drive destroys all volatile and non-volatile evidence needed for dynamic and forensic analysis, and should only occur after evidence collection and containment.

Answer

Delete the DLL file to stop the malware

Answer

Reimage the hard drive to remove the malware

Question 15

A forensic analyst is examining an Android device using ADB extraction. Which TWO statements about ADB extraction are true?

Accepted Answer

ADB extraction requires USB debugging to be enabled on the device. Option A is correct because ADB (Android Debug Bridge) communication over USB is only possible when the device has USB debugging enabled in Developer Options; without it, the adb daemon on the host cannot establish a session with the device. Option E is correct because, once USB debugging is on, the device presents an RSA key fingerprint prompt and the host must be authorized (the device stores the host's public key in adb_keys); an unauthorized host is rejected, so the analyst must accept the prompt or pre-provision the key. Option B is wrong because non-rooted ADB access is confined to the shell user's permissions and cannot read protected app data or system partitions. Option C is wrong because ADB extraction is a logical acquisition (e.g., adb pull, adb backup) and cannot produce a bit-for-bit physical image of the flash storage. Option D is wrong because deleted files in unallocated space are only recoverable from a physical image or raw flash dump, not through ADB's logical file-level access.

Answer

ADB extraction allows full file system access without root

Answer

ADB extraction can acquire a physical image of the device

Answer

ADB extraction can recover deleted files from unallocated space