CHFI Mobile and Malware Forensics Practice Test 3 — 15 Questions

Question 1

During a mobile forensic investigation of an iPhone, the examiner extracts data using a physical acquisition method. Which of the following BEST describes the level of data recovery achieved by this method?

Accepted Answer

It creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space. Physical acquisition creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space, providing the most complete data recovery.

Answer

It recovers the file system but not deleted files

Answer

It extracts data via the user interface by manually interacting with the device

Answer

It recovers only logical files visible to the operating system

Question 2

A forensic analyst is examining an iOS backup taken from a suspect's iPhone using iTunes. Which of the following SQLite databases would contain the suspect's call history?

Accepted Answer

call_history.db. The call history on an iOS device is stored in a SQLite database named `call_history.db` (or `call_history.db` within the root domain of the user's backup). When an iTunes backup is created, this database is included in the backup manifest and can be extracted and queried to retrieve call logs, including timestamps, durations, and phone numbers. Option B is correct because it is the specific database that contains call history records.

Answer

AddressBook.db

Answer

Calendar.sqlitedb

Answer

SMS.db

Question 3

A security analyst observes a process on a Windows system creating a mutex named "Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}" shortly after execution. The analyst also notes outbound connections to an IP address 203.0.113.50 on port 4444. Which malware behaviour indicator is MOST clearly demonstrated?

Accepted Answer

Single-instance execution safeguard and command and control communication. The mutex name 'Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}' is a well-known technique used by malware to ensure only one instance of itself runs on the system, preventing conflicts or multiple infections. The outbound connection to 203.0.113.50 on TCP port 4444 is a classic indicator of command and control (C2) communication, as port 4444 is commonly associated with reverse shells and C2 traffic (e.g., Metasploit default). Together, these two behaviors directly demonstrate single-instance execution safeguard and C2 communication.

Answer

Anti-debugging technique through timing checks

Answer

File encryption using a hardcoded AES key

Answer

Persistence mechanism via registry run keys

Question 4

During a malware analysis, an analyst uses a tool to monitor registry changes, file system modifications, and process activity simultaneously. Which tool is BEST suited for this integrated monitoring?

Accepted Answer

Process Monitor. Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

Answer

Wireshark

Answer

Regshot

Answer

Process Explorer

Question 5

Which of the following mobile forensic tools is specifically known for its ability to perform advanced extractions on iOS devices, including bypassing the lock screen on many models?

Accepted Answer

GrayKey. GrayKey is specifically designed for advanced iOS extractions, leveraging a combination of hardware and software exploits to bypass the lock screen on many iPhone models, including recent ones. Unlike general-purpose forensic tools, GrayKey focuses exclusively on iOS and uses techniques like checkm8 bootrom exploit or brute-force attacks via USB to gain access to encrypted device data.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 6

An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?

Accepted Answer

Logical acquisition via ADB backup. The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.

Answer

Manual acquisition through device UI

Answer

Physical acquisition via JTAG

Answer

File system acquisition via dd

Question 7

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 8

Which of the following tools is BEST suited for performing static analysis of a malware binary to identify strings, headers, and imported functions without executing the file?

Accepted Answer

IDA Pro. IDA Pro is the correct choice because it is a disassembler and debugger specifically designed for static analysis of binary executables. It allows an analyst to examine strings, PE/ELF headers, and imported functions without executing the file, making it ideal for malware reverse engineering. In contrast, the other options require execution or focus on runtime behavior.

Answer

Cuckoo Sandbox

Answer

Any.run

Answer

Process Monitor

Question 9

A forensic examiner is analyzing an Android device and wants to extract the database containing the user's text messages (SMS). In which directory would the examiner typically find the SMS database on a non-rooted device?

Accepted Answer

/data/data/com.android.providers.telephony/databases/. The SMS database on Android devices is stored by the telephony provider, which manages SMS/MMS messages. On non-rooted devices, the database is located at /data/data/com.android.providers.telephony/databases/mmssms.db, as the package com.android.providers.telephony is the system application responsible for handling SMS and MMS operations.

Answer

/data/data/com.android.providers.contacts/databases/

Answer

/data/data/com.android.providers.calendar/databases/

Answer

/data/data/com.android.providers.downloads/databases/

Question 10

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 11

Which mobile forensic acquisition method is MOST likely to retrieve deleted text messages from an iPhone that was not jailbroken and has no passcode?

Accepted Answer

Physical acquisition via forensic tool like Cellebrite UFED. Physical acquisition (A) creates a bit-for-bit copy of the entire flash storage, including unallocated space where deleted text messages (stored in SQLite WAL/SHM/journal files) often reside. Since the iPhone has no passcode, the forensic tool can bypass the lock screen and access the raw NAND, allowing recovery of deleted records that logical or file-system methods cannot reach because they only copy allocated files.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by browsing the device

Answer

File system acquisition via AFC (Apple File Conduit)

Question 12

Which of the following is an indicator of compromise (IoC) that is LEAST likely to change when malware mutates through polymorphic techniques?

Accepted Answer

Registry key created by the malware. Registry keys created by malware are often tied to persistence mechanisms (e.g., Run keys) or configuration storage that remain consistent across polymorphic mutations. While the malware's code and file hash change with each mutation, the registry key path and value name typically stay the same to ensure the malware can re-launch or maintain its foothold. This makes the registry key a stable indicator of compromise (IoC) that is least likely to change.

Answer

MD5 hash of the malware file

Answer

File name of the malware

Answer

Import hash (IMPHASH)

Question 13

A forensic examiner is analyzing an iOS device backup and wants to extract the user's iCloud-related artefacts. Which TWO of the following are typical sources of iCloud artefacts in an iTunes backup?

Accepted Answer

com.apple.accounts.plist. Option B is correct because the `com.apple.accounts.plist` file in an iTunes backup stores the user's iCloud account configuration, including the primary iCloud email address and associated account metadata. This plist is a direct source for identifying which iCloud account was configured on the device, making it a key artefact for iCloud-related analysis.

Answer

AddressBook.db

Answer

Call_history.db

Answer

SMS.db

Question 14

During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?

Accepted Answer

Network connection to 198.51.100.10:8080. Option B is correct because the outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

Answer

MD5 hash of the original malware file

Answer

Mutex name created by the malware

Question 15

An Android forensic examiner performs a physical acquisition on a device. Which TWO of the following are typical artefacts that can be recovered from the /data/data/ directory on a non-rooted device if the acquisition method allows full file system access?

Accepted Answer

App-specific SQLite databases. On a non-rooted Android device, the /data/data/ directory contains application-specific data, including SQLite databases and Shared Preferences XML files. These are typical artefacts because apps store structured data (e.g., user credentials, chat logs) in SQLite databases and configuration settings in Shared Preferences XML files. A physical acquisition with full file system access can recover these files even without root, as the acquisition method bypasses normal permission restrictions.

Answer

Bootloader configuration

Answer

Recovery mode logs

Answer

Kernel logs