CHFI Mobile and Malware Forensics Practice Test 5 — 15 Questions

Question 1

During a mobile forensic examination of an iPhone, the examiner wants to acquire the most data possible, including deleted files and unallocated space. Which acquisition type should be used?

Accepted Answer

Physical acquisition. Physical acquisition creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. This is the only method that captures the raw NAND memory, allowing recovery of data from unallocated blocks and slack space that logical and file system acquisitions skip.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 2

A security analyst discovers a suspicious file on a Windows system with the hash 'd41d8cd98f00b204e9800998ecf8427e'. Which type of indicator of compromise (IoC) is this hash most commonly associated with?

Accepted Answer

File hash indicator. The hash 'd41d8cd98f00b204e9800998ecf8427e' is the MD5 hash of an empty file (zero bytes). In malware forensics, a file hash is a classic file-based indicator of compromise (IoC) used to uniquely identify known malicious files. Option D is correct because this hash directly identifies a specific file, making it a file hash indicator.

Answer

Network indicator

Answer

Behavioural indicator

Answer

Registry key indicator

Question 3

An analyst is performing malware analysis and executes a suspicious binary in a sandbox. The sandbox reports that the binary creates a mutex named 'Global\DRIVER_UPDATE_MTX' before attempting to connect to 'http://malicious.com/update'. Which tool would BEST capture the network traffic during dynamic analysis?

Accepted Answer

Wireshark. Wireshark is the correct tool because it captures and analyzes network packets at the protocol level, allowing the analyst to inspect the HTTP request to 'http://malicious.com/update', including headers, payload, and any subsequent data exfiltration. Dynamic analysis of malware requires monitoring network traffic to identify command-and-control (C2) communications, and Wireshark provides full packet capture (PCAP) for this purpose.

Answer

Regshot

Answer

Process Explorer

Answer

Process Monitor

Question 4

In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Answer

GrayKey

Question 5

During a forensic investigation of an Android device, the examiner uses ADB to extract data. Which command would create a full backup of the device's data partition, including app data and shared storage?

Accepted Answer

adb backup -f backup.ab -apk -shared -all. Option A is correct because the `adb backup -f backup.ab -apk -shared -all` command creates a full Android backup that includes both app data (via `-apk`) and shared storage (via `-shared`), outputting a single `.ab` file. This is the standard ADB method for non-rooted devices to capture a comprehensive backup of the data partition, including user-installed apps and their data, as well as internal shared storage like `/sdcard`.

Answer

adb shell dd if=/dev/block/mmcblk0 of=/data/backup.img

Answer

adb pull /data/data/

Answer

adb restore backup.ab

Question 6

Which of the following is the primary purpose of performing static analysis on a suspicious binary?

Accepted Answer

Analysing the binary's code and structure without executing it. Static analysis examines a binary's code and structure without executing it, allowing analysts to identify malicious indicators such as embedded strings, import tables, and cryptographic constants. This approach avoids triggering anti-analysis mechanisms that activate upon execution, making it a foundational step in malware forensics.

Answer

Capturing network traffic generated by the binary

Answer

Observing the binary's runtime behaviour in a sandbox

Answer

Modifying the binary to bypass anti-analysis techniques

Question 7

A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?

Accepted Answer

Google account authentication tokens and cached account data. Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.

Answer

All installed application APK files

Answer

Full SMS message history

Answer

Encryption keys for user data partition

Question 8

During malware analysis, an analyst discovers that a sample uses a technique to modify its own code at runtime to evade signature detection. Which anti-forensic technique does this describe?

Accepted Answer

Packing/Obfuscation. The technique of modifying code at runtime to evade signature detection is known as packing or obfuscation. Packers compress or encrypt the original executable and wrap it with a small stub that decompresses or decrypts the code in memory during execution, thereby altering the static file signature. This runtime modification allows the malware to bypass signature-based antivirus and forensic tools that rely on static analysis of the binary on disk.

Answer

Log wiping

Answer

Encryption

Answer

Timestomping

Question 9

An iOS forensic examiner recovers a Keychain dump from an iPhone. Which of the following types of data is typically NOT stored in the iOS Keychain?

Accepted Answer

SMS message content. The iOS Keychain is designed to store small, sensitive credentials such as passwords, keys, and certificates. SMS message content is stored in the SMS/MMS database (sms.db) under the protected /private/var/mobile/Library/SMS/ directory, not in the Keychain. Keychain items are encrypted per-app or per-service, whereas SMS messages are managed by the Messages app and stored in a SQLite database with its own encryption layer.

Answer

Wi-Fi passwords

Answer

Safari saved passwords

Answer

VPN credentials

Question 10

During dynamic analysis of a Windows malware sample, Process Monitor shows repeated writes to 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. What does this behaviour indicate?

Accepted Answer

The malware is establishing persistence to run at system startup. The registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' is a standard Windows autorun location. Malware writing to this key ensures that its executable is launched automatically every time the system boots, which is a classic persistence mechanism. Process Monitor capturing repeated writes confirms the malware is actively establishing this startup persistence.

Answer

The malware is disabling Windows Defender

Answer

The malware is modifying network configuration

Answer

The malware is performing log wiping

Question 11

Which mobile forensic tool is commonly used for physical extraction of iOS devices via checkm8 exploit?

Accepted Answer

GrayKey. GrayKey is correct because it is a dedicated forensic tool that leverages the checkm8 bootrom exploit (CVE-2019-15971) to perform physical extraction on iOS devices. The checkm8 exploit is unpatchable in hardware, allowing GrayKey to bypass the device's security enclave and extract a full file system image, including encrypted data, from iPhones up to the iPhone X.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 12

A security analyst notices a process named 'svchost.exe' running from the directory 'C:\Users\Public\svchost.exe'. This is suspicious because legitimate svchost.exe runs from 'C:\Windows\System32'. What type of indicator is this?

Accepted Answer

Behavioural indicator. B is correct because the presence of svchost.exe in C:\Users\Public\ instead of C:\Windows\System32 indicates a deviation from the expected execution path, which is a classic behavioral indicator. Behavioral indicators focus on anomalous actions or file placements rather than static attributes like hashes or network traffic.

Answer

Network indicator

Answer

File hash indicator

Answer

Registry key indicator

Question 13

Which TWO of the following are SQLite databases commonly analysed during iOS forensic examinations?

Accepted Answer

call_history.db. B is correct because `call_history.db` is a SQLite database on iOS devices that stores call logs, including incoming, outgoing, and missed calls with timestamps and durations. Forensic examiners analyze this database to reconstruct communication patterns and timelines during investigations.

Answer

AddressBook.db

Answer

com.apple.mobilemail.plist

Answer

keychain.plist

Question 14

A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?

Accepted Answer

Process Monitor. Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.

Answer

Ghidra

Answer

PEiD

Question 15

Which TWO of the following are valid acquisition types in mobile forensics, ranked from most to least data recovered?

Accepted Answer

Physical. Physical acquisition (option B) captures the entire flash memory bit-for-bit, including deleted files and unallocated space, providing the most complete data recovery. Logical acquisition (option D) extracts only active files and system data via the operating system's API, yielding less data than physical but more than manual or cloud methods. Together, they represent the two valid acquisition types ranked from most to least data recovered in mobile forensics.

Answer

Manual

Answer

Cloud

Answer

File system