CHFI Mobile and Malware Forensics Practice Test 7 — 15 Questions

Question 1

During a mobile forensics investigation, an examiner needs to acquire data from an iPhone running iOS 14. Which of the following acquisition methods provides the MOST complete data extraction?

Accepted Answer

Physical acquisition via JTAG or chip-off. Physical acquisition via JTAG or chip-off provides the most complete data extraction because it captures a bit-for-bit copy of the raw NAND flash memory, including deleted files, unallocated space, and system partitions that are otherwise inaccessible. On iOS 14, Apple's security features (e.g., full-disk encryption, SEP) limit logical and file system methods, but physical techniques bypass the operating system to retrieve the entire storage image, albeit with decryption challenges.

Answer

File system acquisition via jailbreak

Answer

Manual acquisition by browsing the device

Answer

Logical acquisition via iTunes backup

Question 2

A security analyst suspects malware infection on a Windows workstation. They run Process Monitor and observe that a process named 'svch0st.exe' creates a mutex named 'Global\Mutex_1234' and writes to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'. Which malware persistence mechanism is being used?

Accepted Answer

Run key persistence. The process 'svch0st.exe' writes to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run', which is a classic Run key used for automatic program execution at user logon. This is the most common malware persistence mechanism, as any executable referenced there will start each time the user logs in. The creation of a mutex named 'Global\Mutex_1234' is a common anti-reinfection technique to ensure only one instance of the malware runs, but the persistence is established via the Run key.

Answer

Scheduled task creation

Answer

Service installation

Answer

DLL search order hijacking

Question 3

During a malware analysis session, an analyst uses a tool to view the import address table (IAT) of a suspicious PE file. The tool shows imports from ws2_32.dll and wininet.dll. Which of the following tools would BEST allow the analyst to statically analyze the binary and view the IAT?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is a static analysis tool that can parse the PE file structure, including the Import Address Table (IAT), to reveal which DLLs and functions are imported. Since the question specifies static analysis and viewing the IAT, PEiD is the best choice because it directly reads the PE headers without executing the file.

Answer

Wireshark

Answer

Process Monitor

Answer

Cuckoo Sandbox

Question 4

An Android phone is found at a crime scene. The phone is locked with a PIN. The forensic examiner wants to extract data without bypassing the lock. Which of the following is the MOST appropriate logical acquisition method?

Accepted Answer

Perform an ADB backup. ADB backup (option C) is the most appropriate logical acquisition method for a locked Android phone because it uses the Android Backup protocol over ADB, which can extract application data without needing to bypass the lock screen, provided USB debugging is enabled and the device authorizes the backup. This method does not require root access or physical disassembly, making it a non-invasive logical acquisition technique.

Answer

Use Cellebrite UFED to perform a file system extraction

Answer

Perform a physical acquisition via JTAG

Answer

Use ADB to pull /data/data/ directory

Question 5

A forensic analyst is examining a SQLite database from an iOS device backup. The database contains a table named 'message' with columns 'ROWID', 'text', 'handle_id', and 'date'. This database is MOST likely part of which iOS system database?

Accepted Answer

SMS.db. The 'message' table with columns 'ROWID', 'text', 'handle_id', and 'date' is the core schema of the SMS.db database on iOS devices. This database stores iMessage and SMS/MMS messages, where 'handle_id' links to the 'handle' table for contact identifiers and 'date' stores the timestamp in Apple's absolute time (seconds since 2001-01-01). The presence of these specific columns confirms it is the SMS/Message database.

Answer

call_history.db

Answer

Calendar.db

Answer

AddressBook.db

Question 6

During malware dynamic analysis in a sandbox, a sample creates a file named 'C:\Users\Admin\AppData\Local\Temp\svchost.dll' and then executes 'rundll32.exe C:\Users\Admin\AppData\Local\Temp\svchost.dll,Start'. This behavior is indicative of which technique?

Accepted Answer

DLL side-loading. D is correct because the sample places a malicious DLL named 'svchost.dll' in a user-writable directory (Temp) and then invokes it via rundll32.exe, which is a legitimate Microsoft binary. This exploits the Windows DLL search order: when rundll32.exe loads the DLL without specifying a full path, Windows first searches the application's directory, then system directories, but here the attacker explicitly provides the full path to the Temp folder, bypassing the search order and forcing the load of the attacker's DLL. This is classic DLL side-loading, where a trusted executable loads a malicious DLL from a non-standard location.

Answer

DLL injection

Answer

Process hollowing

Answer

Reflective DLL loading

Question 7

A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?

Accepted Answer

The device must be rooted. A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

Answer

The bootloader must be unlocked

Answer

The device must be in recovery mode

Answer

USB debugging must be enabled

Question 8

Which of the following tools is designed specifically for dynamic analysis of malware by executing it in a controlled, isolated environment?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is an open-source automated malware analysis system designed specifically for dynamic analysis. It executes suspicious files in a controlled, isolated environment (a virtual machine) and monitors their behavior, including system calls, file system changes, registry modifications, and network traffic, to produce a comprehensive report without risking the host system.

Answer

PEiD

Answer

Ghidra

Answer

IDA Pro

Question 9

An investigator examines an iPhone backup file. Inside the backup manifest, they find a file path 'AppDomainGroup-group.com.example.app'. This indicates the data belongs to which type of app container?

Accepted Answer

A shared container for multiple apps from the same developer. The file path 'AppDomainGroup-group.com.example.app' indicates a shared container used by App Groups, a feature that allows multiple apps from the same developer to share data. This is not a sandbox container for a single app, nor is it a system or temporary container. The 'group' prefix and the bundle identifier pattern confirm it belongs to a shared app group container.

Answer

System container for iOS system apps

Answer

The app's sandbox container

Answer

Temporary container for app data

Question 10

During a forensic examination of a Windows system infected with ransomware, the analyst finds that the file timestamps (creation, modification, access) for several critical system files have been altered to match legitimate Windows files. Which anti-forensic technique is MOST likely being used?

Accepted Answer

Timestomping. Timestomping is the deliberate alteration of file timestamps (creation, modification, access) to mislead forensic investigators. In this scenario, the ransomware modified critical system file timestamps to match legitimate Windows files, which is the hallmark of timestomping. This technique is commonly used to evade timeline analysis and hide the true sequence of malicious activity.

Answer

Data hiding via ADS

Answer

Steganography

Answer

Log wiping

Question 11

A forensic analyst receives a mobile device that has been factory reset. Which of the following types of data is MOST likely to be recoverable using advanced forensic techniques?

Accepted Answer

Google account tokens and cached credentials. Option C is correct because a factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.

Answer

Deleted text messages and call logs, but not app data

Answer

All user data, as factory reset only deletes file pointers

Answer

No data is recoverable after a factory reset on modern devices

Question 12

A security analyst is using Wireshark during a malware analysis session. The analyst observes a series of DNS queries to a domain 'malware-c2.example.com' every 60 seconds. This behavior is indicative of which malware characteristic?

Accepted Answer

Command and control (C2) communication. The periodic DNS queries to 'malware-c2.example.com' every 60 seconds are a classic heartbeat or beaconing mechanism used by malware to maintain persistent communication with its command and control (C2) server. This regular check-in allows the attacker to send commands or receive stolen data without requiring the malware to initiate a direct connection, which could be blocked by firewalls. The fixed interval and specific domain indicate a programmed C2 channel rather than a one-time data transfer or tunneling technique.

Answer

Data exfiltration

Answer

DNS tunneling

Answer

Propagation via network scanning

Question 13

A forensic examiner is analyzing a malware sample that creates the following registry keys for persistence: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Malware', 'HKLM\System\CurrentControlSet\Services\MalService', and 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'. Which TWO of the following statements are TRUE regarding these persistence mechanisms?

Accepted Answer

The Run key executes the malware when the user logs in.. Option A is correct because the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' key is a well-known autostart location that executes the specified program each time the user logs into their account. This is a common persistence mechanism used by malware to re-launch after a reboot, as Windows Explorer reads this key during the user logon process.

Answer

The Services key requires administrative privileges to create.

Answer

The Winlogon Shell key replaces the default Windows shell (explorer.exe) completely.

Answer

All three keys ensure persistence across reboots and user sessions.

Question 14

Which THREE of the following are common indicators of compromise (IoCs) that can be used to detect malware infections?

Accepted Answer

Registry key created by malware for persistence. Option C is correct because malware often creates registry keys (e.g., under `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`) to achieve persistence, ensuring it executes automatically on system startup. Detecting such unauthorized registry modifications is a common indicator of compromise (IoC) in forensic investigations.

Answer

The user's favorite color

Answer

The brand of the victim's computer

Question 15

During a mobile forensics investigation of an Android device, the examiner finds that the user's Google account data is stored locally. Which TWO of the following artefacts are typically stored in the device's /data/system/ or /data/data/ directories related to Google account information?

Accepted Answer

accounts.db. The accounts.db file in /data/system/ is the SQLite database that stores all Google account credentials, including email addresses and authentication tokens used by the Android Account Manager. This is a primary artifact for identifying which Google accounts were configured on the device and their sync status.

Answer

GoogleLoginService.java

Answer

contacts.db

Answer

SMS.db