CHFI Mobile and Malware Forensics Practice Test 2 — 15 Questions

Question 1

Which of the following mobile forensic tools is specifically known for its ability to perform advanced extractions on iOS devices, including bypassing the lock screen on many models?

Accepted Answer

GrayKey. GrayKey is specifically designed for advanced iOS extractions, leveraging a combination of hardware and software exploits to bypass the lock screen on many iPhone models, including recent ones. Unlike general-purpose forensic tools, GrayKey focuses exclusively on iOS and uses techniques like checkm8 bootrom exploit or brute-force attacks via USB to gain access to encrypted device data.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 2

A forensic examiner is analyzing an Android device and wants to extract the database containing the user's text messages (SMS). In which directory would the examiner typically find the SMS database on a non-rooted device?

Accepted Answer

/data/data/com.android.providers.telephony/databases/. The SMS database on Android devices is stored by the telephony provider, which manages SMS/MMS messages. On non-rooted devices, the database is located at /data/data/com.android.providers.telephony/databases/mmssms.db, as the package com.android.providers.telephony is the system application responsible for handling SMS and MMS operations.

Answer

/data/data/com.android.providers.contacts/databases/

Answer

/data/data/com.android.providers.calendar/databases/

Answer

/data/data/com.android.providers.downloads/databases/

Question 3

Which mobile forensic acquisition method is MOST likely to retrieve deleted text messages from an iPhone that was not jailbroken and has no passcode?

Accepted Answer

Physical acquisition via forensic tool like Cellebrite UFED. Physical acquisition (A) creates a bit-for-bit copy of the entire flash storage, including unallocated space where deleted text messages (stored in SQLite WAL/SHM/journal files) often reside. Since the iPhone has no passcode, the forensic tool can bypass the lock screen and access the raw NAND, allowing recovery of deleted records that logical or file-system methods cannot reach because they only copy allocated files.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by browsing the device

Answer

File system acquisition via AFC (Apple File Conduit)

Question 4

Which of the following is an indicator of compromise (IoC) that is LEAST likely to change when malware mutates through polymorphic techniques?

Accepted Answer

Registry key created by the malware. Registry keys created by malware are often tied to persistence mechanisms (e.g., Run keys) or configuration storage that remain consistent across polymorphic mutations. While the malware's code and file hash change with each mutation, the registry key path and value name typically stay the same to ensure the malware can re-launch or maintain its foothold. This makes the registry key a stable indicator of compromise (IoC) that is least likely to change.

Answer

MD5 hash of the malware file

Answer

File name of the malware

Answer

Import hash (IMPHASH)

Question 5

A forensic analyst is examining an Android device that has been factory reset. Which of the following artefacts is MOST likely to persist after a factory reset and provide valuable evidence?

Accepted Answer

The contents of the SD card's Android/data directory. A factory reset on Android wipes the internal user data partition (/data), which includes accounts.db containing Google authentication tokens and sync settings, as well as gatekeeper.password.key and mmssms.db. However, it does not format the external SD card, so files under Android/data on the SD card remain intact and can provide valuable evidence.

Answer

Google account authentication tokens and sync settings

Answer

Deleted SMS messages from the mmssms.db WAL file

Answer

The user's pattern lock hash stored in gatekeeper.password.key

Question 6

During a forensic investigation of a Windows system infected with ransomware, the analyst discovers that the malware deleted volume shadow copies using vssadmin.exe. Which anti-forensic technique does this represent, and what is its primary purpose?

Accepted Answer

Log wiping; to remove forensic evidence of file changes and prevent data recovery. Deleting Volume Shadow Copies using vssadmin.exe is a classic example of log wiping (anti-forensic technique). The primary purpose is to remove forensic evidence of file changes and prevent data recovery, as shadow copies contain previous versions of files that could be used to restore encrypted data or track the ransomware's activity.

Answer

Encryption; to encrypt the shadow copies to prevent analysis

Answer

Timestomping; to alter timestamps of the shadow copy files

Answer

Data hiding; to conceal the malware's files within shadow copies

Question 7

A forensic analyst is examining an iOS device backup and wants to extract call history records. Which SQLite databases and/or files contain relevant call history data? (Select TWO.)

Accepted Answer

AddressBook.db. Option E, call_history.db, is correct because on iOS the call history is stored in the CallHistory database, commonly named call_history.db (or CallHistory.storedata), which contains the call table with records such as phone numbers, dates, durations, and call types. Option C, AddressBook.db, is also correct in this scenario because call history records reference contacts, and the AddressBook database (AddressBook.sqlitedb) supplies the contact names and identifiers needed to resolve the numbers in the call log. The other options do not belong: Notes.sqlite stores notes, SMS.db stores text and multimedia messages, and Calendar.sqlite stores calendar events, none of which hold call history records.

Answer

Notes.sqlite

Answer

SMS.db

Answer

Calendar.sqlite

Question 8

A security analyst discovers a suspicious file on a Windows system with the hash 'd41d8cd98f00b204e9800998ecf8427e'. Which type of indicator of compromise (IoC) is this hash most commonly associated with?

Accepted Answer

File hash indicator. The hash 'd41d8cd98f00b204e9800998ecf8427e' is the MD5 hash of an empty file (zero bytes). In malware forensics, a file hash is a classic file-based indicator of compromise (IoC) used to uniquely identify known malicious files. Option D is correct because this hash directly identifies a specific file, making it a file hash indicator.

Answer

Network indicator

Answer

Behavioural indicator

Answer

Registry key indicator

Question 9

Which mobile forensic tool is commonly used for physical extraction of iOS devices via checkm8 exploit?

Accepted Answer

GrayKey. GrayKey is correct because it is a dedicated forensic tool that leverages the checkm8 bootrom exploit (CVE-2019-15971) to perform physical extraction on iOS devices. The checkm8 exploit is unpatchable in hardware, allowing GrayKey to bypass the device's security enclave and extract a full file system image, including encrypted data, from iPhones up to the iPhone X.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 10

Which TWO of the following are SQLite databases commonly analysed during iOS forensic examinations?

Accepted Answer

call_history.db. Option B (call_history.db) is correct because iOS stores the call log in a SQLite database named call_history.db, located in the user's Library/CallHistory directory, making it a standard artifact for call-detail forensics. Option D (SMS.db) is correct because text and multimedia messages are stored in the SQLite database SMS.db (under Library/SMS), which examiners query for message content, timestamps, and participants. Option A (AddressBook.db) is not the iOS contacts store; iOS contacts are held in the AddressBook.sqlitedb database, so the .db filename is not the commonly analysed artifact. Option C (com.apple.mobilemail.plist) is a property list, not a SQLite database, and holds mail account configuration rather than message records. Option E (keychain.plist) is likewise a plist file (keychain data is stored in keychain-2.db), so it is not a SQLite database analysed for these artifacts.

Answer

AddressBook.db

Answer

com.apple.mobilemail.plist

Answer

keychain.plist

Question 11

A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?

Accepted Answer

Process Monitor. Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.

Answer

Ghidra

Answer

PEiD

Question 12

Which TWO of the following are valid acquisition types in mobile forensics, ranked from most to least data recovered?

Accepted Answer

Physical. Physical acquisition (B) is correct because it creates a bit-for-bit image of the device's flash memory, including deleted data, unallocated space, and hidden partitions, yielding the most data recoverable in mobile forensics. Logical acquisition (D) is correct because it extracts only the logical objects visible through the device's operating system or APIs — such as contacts, SMS, call logs, photos, and app data — which is less than a physical image but still a valid acquisition type ranked below physical. Together, physical and logical are the two recognized acquisition types in the standard most-to-least data hierarchy (physical > file system > logical > manual). Manual (A) is not a true acquisition type but rather on-device review of the UI, cloud (C) pulls data from a service provider's servers rather than the device itself, and file system (E) is an intermediate level that is not one of the two options marked correct here.

Answer

Manual

Answer

Cloud

Answer

File system

Question 13

During an Android forensic examination, an analyst uses ADB to perform a backup of a device. The resulting .ab file is encrypted. Which of the following is the most likely reason for the encryption?

Accepted Answer

The device has a lock screen PIN set, and the backup was created with default settings. When an Android backup is created via ADB with default settings, the resulting .ab file is encrypted using the device's lock screen PIN or password as the encryption key. This is a built-in security feature of the Android Backup Manager to protect backup data from unauthorized access. The encryption is applied regardless of whether full-disk encryption is enabled, as it is a separate layer of protection for the backup stream.

Answer

The backup was created with the -nopassword flag

Answer

The backup file is corrupted

Answer

The device has full-disk encryption enabled

Question 14

Which THREE artefacts are typically recoverable from an iOS iTunes backup?

Accepted Answer

SMS.db containing text messages. Option B (SMS.db containing text messages) is correct because iTunes backups include the SMS database file that stores text and iMessage content, making it a standard forensic artefact. Option C (AddressBook.db containing contacts) is correct because the address book database is part of the backed-up user data and is routinely recoverable from iTunes backups. Option D (Call_history.db containing call logs) is correct because call history is stored in a SQLite database that is included in the iTunes backup set. Option A (RAM dump of running processes) is not recoverable because iTunes backups capture persistent storage, not volatile memory. Option E (iCloud Keychain items) is not included in iTunes backups because Keychain data is protected and synced separately via iCloud, not stored in the local backup.

Answer

RAM dump of running processes

Answer

iCloud Keychain items

Question 15

During a malware analysis session, an analyst uses a tool to view the import address table (IAT) of a suspicious PE file. The tool shows imports from ws2_32.dll and wininet.dll. Which of the following tools would BEST allow the analyst to statically analyze the binary and view the IAT?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is a static analysis tool that can parse the PE file structure, including the Import Address Table (IAT), to reveal which DLLs and functions are imported. Since the question specifies static analysis and viewing the IAT, PEiD is the best choice because it directly reads the PE headers without executing the file.

Answer

Wireshark

Answer

Process Monitor

Answer

Cuckoo Sandbox