CHFI Mobile and Malware Forensics Practice Test 3 — 15 Questions

Question 1

An Android phone is found at a crime scene. The phone is locked with a PIN. The forensic examiner wants to extract data without bypassing the lock. Which of the following is the MOST appropriate logical acquisition method?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform an ADB backup. None of the options are appropriate. ADB backup requires the device to be unlocked and the user to confirm the backup on-screen, which bypasses the lock. ADB pull of /data/data/ requires root access and an unlocked device. Cellebrite UFED file system extraction typically requires an unlocked device or an exploit. JTAG is a physical acquisition, not logical. Thus, there is no valid logical acquisition method among the choices that works on a locked device without bypassing the lock.

Answer

Use Cellebrite UFED to perform a file system extraction

Answer

Perform a physical acquisition via JTAG

Answer

Use ADB to pull /data/data/ directory

Question 2

During malware dynamic analysis in a sandbox, a sample creates a file named 'C:\Users\Admin\AppData\Local\Temp\svchost.dll' and then executes 'rundll32.exe C:\Users\Admin\AppData\Local\Temp\svchost.dll,Start'. This behavior is indicative of which technique?

Accepted Answer

DLL side-loading. DLL side-loading occurs when a trusted executable loads a malicious DLL because the DLL is placed in a directory the executable searches, typically without explicit user input. In this case, rundll32.exe is instructed to load the DLL by specifying its full path as a command-line parameter. This is a simple DLL execution technique, not side-loading. None of the provided options accurately describes this behavior.

Answer

DLL injection

Answer

Process hollowing

Answer

Reflective DLL loading

Question 3

A forensic examiner is analyzing a malware sample that creates the following registry keys for persistence: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Malware', 'HKLM\System\CurrentControlSet\Services\MalService', and 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'. Which TWO of the following statements are TRUE regarding these persistence mechanisms?

Accepted Answer

The Run key executes the malware when the user logs in.. Option A is correct because the HKCU\...\CurrentVersion\Run key is a per-user autostart location that launches its entries when that specific user logs on. Option B is correct because a service registered under HKLM\System\CurrentControlSet\Services is started by the Service Control Manager, typically as SYSTEM before any interactive user logon. Option C is correct because creating a service key under HKLM\System\CurrentControlSet\Services requires administrative privileges due to the protected HKLM hive ACL. Option E is correct because all three listed mechanisms provide persistence across reboots and user sessions: Run and Winlogon Shell are re-read at logon, and the service is restarted by the SCM at boot. Option D is not correct because the Winlogon Shell value normally specifies the user shell (explorer.exe) and can be modified to launch additional or alternate shells, but it does not inherently 'completely replace' the default shell in every case.

Answer

The Winlogon Shell key replaces the default Windows shell (explorer.exe) completely.

Question 4

During a mobile forensics investigation of an Android device, the examiner finds that the user's Google account data is stored locally. Which TWO of the following artefacts are typically stored in the device's /data/system/ or /data/data/ directories related to Google account information?

Accepted Answer

accounts.db. Option A (accounts.db) is correct because Android stores account metadata, including Google account names and types, in the SQLite database /data/system/accounts.db (or /data/system/users/0/accounts.db on newer versions). Option E (GoogleLoginService accounts and tokens) is correct because authentication artifacts such as account records and OAuth tokens associated with GoogleLoginService are persisted under /data/system/ and /data/data/com.google.android.gms/ (or related Google services directories). Option B is incorrect because GoogleLoginService.java is a source code file, not a runtime forensic artefact stored on the device. Option C is incorrect because contacts.db is a contacts database typically found in the contacts provider's data directory, not a Google account artefact in /data/system/. Option D is incorrect because SMS.db stores text messages in the telephony provider's database, unrelated to Google account information.

Answer

GoogleLoginService.java

Answer

contacts.db

Answer

SMS.db

Question 5

During a malware investigation, an analyst uses Process Monitor to observe a suspicious executable. The tool reveals that the process attempts to write to 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' and creates a file named 'svchost.exe' in 'C:\Users\Public\'. What is the MOST likely goal of this behavior?

Accepted Answer

Disabling security software by modifying service entries. The behavior of writing to the Run registry key and creating a masqueraded svchost.exe is commonly used to disable security software. By adding an entry to the Run key, the malware ensures it executes at startup, and the svchost.exe file may be designed to interfere with security services or replace legitimate files. Modifying service entries (such as security software services) often requires administrative privileges, and the observed actions are consistent with preparing to disable defenses.

Answer

Exfiltrating data to a remote C2 server

Answer

Establishing persistence by adding an auto-start entry

Answer

Privilege escalation by masquerading as a legitimate system process

Question 6

During a mobile forensic examination of an iOS device, the analyst encounters encrypted backups. Which THREE of the following are valid methods to access the data?

Accepted Answer

Obtaining the backup password from the device owner through legal process. Option C is correct because the backup password is user-set and can be lawfully obtained from the device owner via legal process (e.g., subpoena or consent), after which the encrypted iTunes/Finder backup can be decrypted and parsed. Option D is correct because tools such as Elcomsoft Phone Breaker (or Hashcat/John the Ripper against the backup keybag) can perform dictionary or brute-force attacks against the backup password, and iOS backup encryption uses PBKDF2 with a limited iteration count that makes such attacks feasible for weak passwords. Option E is correct because GrayKey performs a passcode bypass/brute-force on the device itself; once the passcode is recovered or bypassed, the device can be unlocked and a trusted backup can be created or the existing backup key can be extracted, allowing access to the encrypted backup data. Option A is not valid because ADB is the Android Debug Bridge and does not apply to iOS logical acquisition. Option B is not valid because Cellebrite UFED cannot simply 'force' a physical extraction of an encrypted iOS backup without the backup password or an unlocked/trusted device; physical extraction on modern iOS devices requires a passcode bypass or other exploit, not a blanket force option.

Answer

Performing a logical acquisition via ADB

Answer

Using Cellebrite UFED to force a physical extraction without backup

Question 7

A forensic analyst needs to acquire evidence from an iPhone 12 running iOS 15. The device is passcode-locked and cannot be unlocked. Which acquisition method should be used to obtain the MOST data possible?

Accepted Answer

Physical acquisition via GrayKey or Cellebrite. GrayKey and Cellebrite perform physical acquisition by exploiting bootrom or iBoot vulnerabilities (e.g., checkm8 on older devices) or using advanced brute-force techniques to extract the full file system image, including encrypted keychain data and deleted files. This method bypasses the passcode lock and retrieves the maximum amount of data from an iPhone 12 running iOS 15, as logical and manual methods are severely limited by the locked state.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by photographing the screen

Answer

File system acquisition via jailbreak

Question 8

A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?

Accepted Answer

Encrypted app data from /data/data/. After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.

Answer

Google account tokens stored in AccountManager

Answer

System logs in /data/log/

Answer

Deleted text messages from SQLite files

Question 9

Which tool can be used to extract evidence from Android devices through the Android Debug Bridge (ADB) and is often used for logical acquisition?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is a widely used forensic tool that leverages Android Debug Bridge (ADB) to perform logical acquisition of Android devices. ADB allows the tool to communicate with the device's operating system via USB debugging, enabling extraction of call logs, contacts, SMS, and application data without physical chip-off. This makes it the correct choice for logical acquisition over ADB.

Answer

PEiD

Answer

Cuckoo Sandbox

Answer

GrayKey

Question 10

A forensic analyst is examining an Android device and wants to recover Google account artefacts, such as the last sync timestamp and cached email addresses. Where on the device (in /data/data/) would these artefacts MOST likely be stored?

Accepted Answer

com.google.android.gms. The Google account artefacts, including the last sync timestamp and cached email addresses, are stored within the package 'com.google.android.gms' (Google Play Services). This package manages authentication tokens, sync settings, and account metadata in its databases (e.g., 'accounts.db' or 'gms_credentials.db') under /data/data/com.google.android.gms/databases/. The last sync timestamp is typically recorded in the 'sync_state' table, while cached email addresses appear in the 'accounts' table.

Answer

com.android.providers.telephony

Answer

com.android.providers.contacts

Answer

com.android.settings

Question 11

An incident responder finds a file named 'photo.jpg' on a compromised system. The file size is 2 MB and it is located in a temp directory. The file's SHA256 hash is 5d41402abc4b2a76b9719d911017c592. What is the BEST next step to determine if this file is malicious?

Accepted Answer

Compare the hash against known malware hashes in a threat intelligence database. Comparing the SHA256 hash of the file against a threat intelligence database (e.g., VirusTotal, AlienVault OTX) is the fastest, least intrusive method to determine if the file is known malware. Since the file is 2 MB and located in a temp directory, it could be a legitimate image or a disguised executable; hash comparison leverages existing threat intelligence without altering the evidence or risking system compromise.

Answer

Delete the file to prevent potential harm

Answer

Perform static analysis using IDA Pro to disassemble the file

Answer

Run the file in a sandbox environment to observe behavior

Question 12

Which mobile forensic tool is specifically designed to extract data from a wide range of mobile devices, including both iOS and Android, and is commonly used by law enforcement agencies?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is the correct answer because it is a dedicated hardware and software solution specifically engineered to extract data from a vast array of mobile devices, including iOS and Android, through both physical and logical acquisition methods. It is widely adopted by law enforcement agencies globally due to its ability to bypass lock screen security, support over 30,000 device profiles, and extract deleted data via advanced techniques like JTAG and chip-off.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager

Question 13

A forensic examiner is analyzing an Android device and needs to extract application data from the /data/data/ directory. Which TWO conditions must be met to access this directory? (Select TWO.)

Accepted Answer

USB debugging must be enabled. Option A is correct because enabling USB debugging allows the examiner to establish an ADB (Android Debug Bridge) connection to the device, which is the standard channel used to issue commands such as 'adb shell' or 'adb pull' against protected paths like /data/data/. Option B is correct because /data/data/ (the per-app private data directory) is owned by each app's UID and protected by Linux DAC permissions, so only root (via 'su' on a rooted device or an engineering/rooted build) can read other applications' subdirectories. Option C is not required: recovery mode is used for flashing images or performing physical/OTA-style acquisitions, but it does not by itself grant access to /data/data/ unless root or an unlocked, permissive environment is also present. Option D is not required: unlocking the bootloader permits flashing custom images or root solutions, but an unlocked bootloader alone does not grant filesystem access to /data/data/. Option E is not required: screen unlock (passcode/biometric) is needed to authorize the ADB host via the RSA key prompt, but it is not the condition that grants read access to the protected /data/data/ directory.

Answer

The device must be in recovery mode

Answer

The bootloader must be unlocked

Answer

The screen must be unlocked

Question 14

During dynamic analysis of a suspected malware sample, an analyst observes the following behaviors: (1) The process creates a service named 'WindowsDefender' that starts automatically. (2) It writes an encrypted payload to the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. (3) It injects code into explorer.exe. (4) It attempts to resolve the domain 'malware-update.com'. (5) It creates a mutex named 'Global\MyMutex'. Which THREE behaviors are indicators of malware persistence? (Select THREE.)

Accepted Answer

Injecting code into explorer.exe. Injecting code into explorer.exe (option A) is a persistence mechanism because the injected code runs within the context of a trusted system process that starts automatically at user logon. By hijacking explorer.exe, the malware ensures its malicious code executes every time the user logs into the system, surviving a reboot without needing a separate startup entry.

Answer

Creating a mutex named 'Global\MyMutex'

Answer

Attempting to resolve the domain 'malware-update.com'

Question 15

During a malware investigation, a forensic analyst observes that a suspicious process creates a mutex named 'Global\MyMutex' and writes to the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. What behavioral indicator does this represent?

Accepted Answer

Persistence mechanism to survive reboot. Writing to the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is processed by the Windows Session Manager (smss.exe) and the Winlogon process at every user logon, causing the specified executable to launch automatically. Combined with the creation of a named mutex (Global\MyMutex) to prevent multiple instances, this behavior indicates the malware is ensuring it survives a system reboot and maintains a single running copy.

Answer

Encryption of sensitive data

Answer

Establishment of a C2 channel

Answer

Attempt to evade sandbox detection