CHFI Mobile and Malware Forensics Practice Test 6 — 15 Questions

Question 1

During an iOS forensic examination, an analyst extracts the SMS.db file from an iTunes backup. Which table within this database contains the actual message content and associated metadata such as timestamps and sender/recipient information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

message. The `message` table in SMS.db stores the actual message content (the `text` field) along with critical metadata such as `date` (Unix timestamp), `is_from_me` (sender/recipient indicator), and `handle_id` (foreign key to the `handle` table). This is the primary table for message body and timestamp data in iOS SMS/MMS forensics.

Answer

chat

Answer

attachment

Answer

handle

Question 2

Which tool is specifically designed for performing physical extraction of iOS devices and is widely used by law enforcement for bypassing passcode restrictions on modern iPhones?

Accepted Answer

GrayKey. GrayKey is specifically designed for physical extraction of iOS devices, leveraging advanced techniques to bypass passcode restrictions on modern iPhones, including those with Secure Enclave and full-disk encryption. It is widely adopted by law enforcement for its ability to perform brute-force attacks on the device's passcode without triggering the auto-wipe feature, making it the correct answer.

Answer

Cellebrite UFED

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Question 3

During a malware analysis, an analyst runs a suspicious executable in a Cuckoo Sandbox and observes that the process creates a mutex named 'Global\XPSS-1.0.0' and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What do these actions MOST likely indicate?

Accepted Answer

The malware is establishing persistence and ensuring only one instance of itself runs.. The mutex 'Global\XPSS-1.0.0' is used to prevent multiple instances of the malware from running simultaneously, which is a common anti-analysis and stability technique. Writing a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard method for achieving persistence, ensuring the malware executes automatically at user logon. Together, these actions directly indicate persistence and single-instance control, not privilege escalation, C2 communication, or hiding.

Answer

The malware is performing privilege escalation by exploiting a known vulnerability.

Answer

The malware is communicating with a command-and-control server to receive further instructions.

Answer

The malware is attempting to hide its presence by using a system mutex name and a legitimate registry location.

Question 4

An investigator recovers a suspicious file from a compromised system. Using PEiD, the file is detected as 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. What is the MOST appropriate next step in the analysis?

Accepted Answer

Unpack the file using the UPX tool or manual unpacking to obtain the original executable.. The PEiD detection of 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX (Ultimate Packer for eXecutables). Packing obfuscates the original code and often evades static analysis. The most appropriate next step is to unpack the file using the UPX tool (with the -d switch) or manual unpacking to recover the original executable for deeper static and dynamic analysis.

Answer

Delete the file as it is likely a false positive from a legitimate UPX-packed application.

Answer

Submit the packed file to VirusTotal to obtain a hash-based detection report.

Answer

Run the file in a sandbox without unpacking to observe dynamic behavior.

Question 5

During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?

Accepted Answer

The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.. IOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Answer

The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.

Answer

The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.

Answer

The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.

Question 6

A security analyst suspects a mobile device is infected with malware that exfiltrates data via DNS queries. Which tool or technique would be MOST effective for detecting this behavior during dynamic analysis?

Accepted Answer

Wireshark to capture and analyze network packets for anomalous DNS queries. D is correct because DNS exfiltration involves encoding stolen data into DNS query fields (e.g., subdomains or TXT records) and sending them to a malicious server. Wireshark captures and analyzes raw network packets, allowing the analyst to inspect DNS query payloads for anomalous patterns such as unusually long hostnames, high query volume, or queries to suspicious domains, which are hallmarks of DNS tunneling.

Answer

PEiD to detect packers in the mobile app binary

Answer

Regshot to compare registry snapshots before and after execution

Answer

Process Monitor to observe registry and file system changes

Question 7

In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?

Accepted Answer

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img. The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.

Answer

adb pull /data data.img

Answer

adb backup -f backup.ab

Answer

adb install physical.img

Question 8

An examiner is analyzing an Android device using Cellebrite UFED. The device is locked with a PIN, and the examiner has no PIN. Which acquisition type should the examiner attempt FIRST to maximize data recovery without destroying evidence?

Accepted Answer

Logical extraction via ADB backup. When an Android device is locked with a PIN and no PIN is known, a logical extraction via ADB backup is the safest first step. ADB backup (adb backup) can capture app data and system settings without requiring root or unlocking the bootloader, and it does not modify the device state, preserving evidence integrity. This method works if USB debugging was previously enabled, which is common in forensic acquisitions, and it avoids the risk of triggering lockout or data wiping that physical methods might cause.

Answer

Manual extraction by photographing the screen

Answer

File system extraction via ADB root shell

Answer

Physical extraction using a bootloader exploit

Question 9

In malware forensics, which of the following is an indicator of compromise (IoC) that can be used to detect a specific malware strain across multiple systems?

Accepted Answer

The file's MD5 hash computed from its binary contents. The MD5 hash of a file's binary contents is a unique cryptographic fingerprint that remains consistent across all copies of the exact same malware strain, regardless of where it is stored or what metadata the filesystem assigns. This makes it a reliable indicator of compromise (IoC) for identifying a specific malware sample across multiple systems, as the hash will match even if file names, sizes, or timestamps differ.

Answer

The file's size in bytes reported by the filesystem

Answer

The file's copyright metadata embedded in the PE header

Answer

The file's creation timestamp as recorded by the operating system

Question 10

A malware analyst is performing dynamic analysis of a suspected trojan in a sandbox environment. Which of the following behaviours are strong indicators that the malware is establishing persistence on the infected system? (Select THREE.)

Accepted Answer

Creating a scheduled task that runs at system startup. Option A is correct because creating a scheduled task configured to trigger at system startup (e.g., via schtasks or the Task Scheduler COM API with a boot/logon trigger) is a classic persistence mechanism that ensures the trojan executes automatically after reboots. Option B is correct because registering a Windows service (e.g., through CreateService or sc.exe) allows the malware to be launched by the Service Control Manager at boot, providing durable, privileged persistence. Option D is correct because writing a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run causes the referenced executable to be launched automatically at user logon, a well-known autostart persistence location. Option C is not a persistence indicator; an outbound connection to port 443 typically reflects command-and-control or exfiltration activity, not survival across reboots. Option E is not a persistence indicator either; creating a named mutex such as Global\MyMutex is commonly used for single-instance enforcement or anti-analysis/anti-sandbox checks, not for maintaining execution on the host.

Answer

Connecting to an IP address on port 443

Answer

Creating a mutex named 'Global\MyMutex'

Question 11

During a mobile forensic investigation, an examiner wants to recover deleted WhatsApp messages from an Android device. Which of the following artefacts should the examiner examine? (Select TWO.)

Accepted Answer

/data/media/0/Android/data/com.whatsapp/. WhatsApp stores media files (images, videos, voice notes) in the external app-specific directory `/data/media/0/Android/data/com.whatsapp/`. Even after a message is deleted from the chat, the media file may remain in this directory if it was not explicitly removed, allowing recovery. Option C is correct because the primary SQLite database `msgstore.db` in `/data/data/com.whatsapp/databases/` contains the chat messages, including deleted entries that are often only marked as deleted but not physically removed until a vacuum operation.

Answer

/data/data/com.android.providers.telephony/databases/mmssms.db

Answer

/data/data/com.whatsapp/files/Avatars/

Answer

/data/data/com.google.android.gms/databases/

Question 12

During a mobile forensic examination of an iPhone, the examiner wants to acquire the most data possible, including deleted files and unallocated space. Which acquisition type should be used?

Accepted Answer

Physical acquisition. Physical acquisition creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. This is the only method that captures the raw NAND memory, allowing recovery of data from unallocated blocks and slack space that logical and file system acquisitions skip.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition

Question 13

An analyst is performing malware analysis and executes a suspicious binary in a sandbox. The sandbox reports that the binary creates a mutex named 'Global\DRIVER_UPDATE_MTX' before attempting to connect to 'http://malicious.com/update'. Which tool would BEST capture the network traffic during dynamic analysis?

Accepted Answer

Wireshark. Wireshark is the correct tool because it captures and analyzes network packets at the protocol level, allowing the analyst to inspect the HTTP request to 'http://malicious.com/update', including headers, payload, and any subsequent data exfiltration. Dynamic analysis of malware requires monitoring network traffic to identify command-and-control (C2) communications, and Wireshark provides full packet capture (PCAP) for this purpose.

Answer

Regshot

Answer

Process Explorer

Answer

Process Monitor

Question 14

In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?

Accepted Answer

Hashcat. Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Answer

GrayKey

Question 15

During a forensic investigation of an Android device, the examiner uses ADB to extract data. Which command would create a full backup of the device's data partition, including app data and shared storage?

Accepted Answer

adb backup -f backup.ab -apk -shared -all. The `adb backup -f backup.ab -apk -shared -all` command creates a full Android backup that includes all apps and their data (via `-all`), includes APK files (via `-apk`), and includes shared storage (via `-shared`), outputting a single `.ab` file. This is the standard ADB method for non-rooted devices to capture a comprehensive logical backup of app data and shared storage.

Answer

adb shell dd if=/dev/block/mmcblk0 of=/data/backup.img

Answer

adb pull /data/data/

Answer

adb restore backup.ab