CHFI Mobile and Malware Forensics Practice Test 8 — 15 Questions

Question 1

During an iOS forensic examination, an analyst extracts the iTunes backup of a suspect iPhone. The analyst wants to review deleted SMS messages. Which SQLite database file should be examined?

Accepted Answer

SMS.db. In iOS forensics, deleted SMS messages are stored in the SMS.db SQLite database located within the iTunes backup. This database contains the `message` table, which retains deleted messages until overwritten by new data, making it the primary target for recovering deleted iMessages and SMS texts.

Answer

AddressBook.db

Answer

Keyboard.db

Answer

call_history.db

Question 2

An Android phone is seized, and the forensic examiner needs to acquire the device in a forensically sound manner. The phone is running Android 12 and has USB debugging enabled. Which acquisition method provides the most complete data without physically modifying the device?

Accepted Answer

Physical acquisition via ADB with appropriate exploit. Option B is correct because physical acquisition via ADB with an appropriate exploit allows the examiner to obtain a complete bit-for-bit copy of the device's flash memory, including deleted data and unallocated space, without physically modifying the device. Since Android 12 has USB debugging enabled, ADB can be used to push an exploit that bypasses security restrictions to perform a physical dump, which is the most comprehensive method available for this scenario.

Answer

File system acquisition via Cellebrite UFED

Answer

Logical acquisition through ADB backup

Answer

Manual extraction using screen captures

Question 3

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

Accepted Answer

Modifying the hosts file with an entry for 192.168.1.1. Option A is correct because modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Answer

Connecting to IP 185.130.5.21 on port 443

Answer

Writing temporary files to %TEMP%

Answer

Creating the mutex 'Global\Mtx_Update'

Question 4

A forensic investigator needs to analyze the keychain data from an iOS device backup. Which tool is specifically designed to decrypt and display iOS keychain contents?

Accepted Answer

Elcomsoft Phone Breaker. Elcomsoft Phone Breaker is specifically designed to decrypt and display iOS keychain contents from backups, including passwords, tokens, and cryptographic keys. It leverages techniques such as brute-force, dictionary attacks, and GPU acceleration to recover the backup password, then extracts and decrypts the keychain data using iOS's Keychain Services API.

Answer

Cellebrite UFED

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Question 5

During a malware investigation, an analyst uses Process Monitor to observe a suspicious executable. The tool reveals that the process attempts to write to 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' and creates a file named 'svchost.exe' in 'C:\Users\Public\'. What is the MOST likely goal of this behavior?

Accepted Answer

Establishing persistence by adding an auto-start entry. Writing to the 'Run' registry key (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) is a classic persistence mechanism: any executable listed there is automatically launched at user logon. Creating a file named 'svchost.exe' in a public directory is a masquerading attempt to blend in with the legitimate svchost.exe (which resides in System32), but the registry write is the definitive indicator of persistence via an auto-start entry.

Answer

Exfiltrating data to a remote C2 server

Answer

Disabling security software by modifying service entries

Answer

Privilege escalation by masquerading as a legitimate system process

Question 6

An Android device is found with factory reset performed. The forensic examiner wants to recover as much data as possible. Which of the following artefacts is MOST likely to survive a factory reset and provide useful evidence?

Accepted Answer

Data stored on the external SD card. Factory reset wipes the /data partition, which includes /data/data/ (app data), AccountManager tokens, and system configuration files like wpa_supplicant.conf. However, external SD cards are typically not formatted during a factory reset because they are user-removable storage. Therefore, data stored on the external SD card (e.g., photos, videos, app backups) often survives intact and can provide valuable forensic evidence.

Answer

Deleted SQLite records from /data/data/

Answer

Google account authentication tokens stored in AccountManager

Answer

Wi-Fi passwords from wpa_supplicant.conf

Question 7

A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?

Accepted Answer

PEiD. PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.

Answer

Cuckoo Sandbox

Answer

Ghidra

Answer

IDA Pro

Question 8

An incident responder receives an alert that a workstation is beaconing to a known malicious IP address. The responder captures network traffic and analyzes it with Wireshark. Which of the following would be an immediate indicator of compromise (IoC) visible in the traffic capture?

Accepted Answer

Repeated connections to a known malicious IP address on a non-standard port. Option D is correct because repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.

Answer

Large file transfers during off-hours

Answer

ARP requests from unknown MAC addresses

Answer

Encrypted payloads using TLS 1.3

Question 9

Which mobile forensic tool is commonly used to perform a physical extraction of an iOS device, including bypassing the lock screen on certain models?

Accepted Answer

GrayKey. GrayKey is a specialized hardware tool designed by Grayshift that performs physical extraction of iOS devices, including bypassing the lock screen on certain models (e.g., iPhone 5 through iPhone X) by exploiting bootrom vulnerabilities or using brute-force techniques. It is widely used in law enforcement for forensic acquisition of iOS devices where logical extraction is insufficient.

Answer

Magnet AXIOM

Answer

Oxygen Forensic Detective

Answer

FTK Imager

Question 10

A security analyst detects that a known malware sample writes to the registry key 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service. This behavior is characteristic of which type of persistence mechanism?

Accepted Answer

Windows service. The malware writes to 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service, which is the exact mechanism for registering a Windows service. This persistence method ensures the malware runs automatically when the system boots, as the Service Control Manager (SCM) loads services based on this registry key. Option D is correct because this behavior directly corresponds to the Windows service persistence technique.

Answer

Scheduled task

Answer

AppInit_DLLs

Answer

Startup folder entry

Question 11

During an Android forensic examination, the analyst uses ADB to run 'adb shell dumpsys batterystats --reset' before acquiring data. What is the MOST likely purpose of this command?

Accepted Answer

This command is not recommended in forensic acquisition as it may destroy potential evidence. Option B is correct because the 'adb shell dumpsys batterystats --reset' command clears the battery statistics logs on the device. In forensic acquisition, any command that modifies or deletes data on the device is considered destructive to evidence. The reset operation removes historical battery data that may contain timestamps and app usage patterns, which could be critical evidence. Therefore, this command is not recommended in forensic acquisition as it may destroy potential evidence.

Answer

To clear battery logs that may contain evidence of app activity

Answer

To ensure the device is in a low-power state for safe extraction

Answer

To optimize device performance during imaging

Question 12

Which of the following is a key difference between static and dynamic malware analysis?

Accepted Answer

Static analysis examines code without execution, dynamic analysis executes the sample. Static malware analysis involves examining the malware's code (e.g., disassembly, strings, headers) without executing it, while dynamic analysis runs the sample in a controlled environment (e.g., sandbox, debugger) to observe its runtime behavior. Option C correctly captures this fundamental distinction: static analysis is code-centric and non-executional, whereas dynamic analysis is behavior-centric and executional.

Answer

Static analysis executes the malware, dynamic does not

Answer

Static analysis requires an internet connection, dynamic does not

Answer

Static analysis is always automated, dynamic is manual

Question 13

A forensic investigator is analyzing a Windows system suspected of malware infection. Which TWO of the following are common persistence mechanisms that malware may use?

Accepted Answer

Scheduled Tasks via schtasks. Scheduled Tasks via schtasks (Option A) are a common persistence mechanism because malware can create a task that runs at system startup or at regular intervals to re-infect or maintain a foothold. The schtasks command allows creating tasks with SYSTEM privileges, often triggered by logon or system boot events, making it a stealthy way to survive reboots.

Answer

Creating a Windows service

Answer

Adding an entry to the hosts file

Answer

Modifying the boot.ini file

Question 14

During a mobile forensic examination of an iOS device, the analyst encounters encrypted backups. Which THREE of the following are valid methods to access the data?

Accepted Answer

Obtaining the backup password from the device owner through legal process. Option C is correct because obtaining the backup password from the device owner through a legal process is a standard and valid method to access encrypted iOS backups. The backup password is required to decrypt the backup data, and if the owner provides it voluntarily or through a court order, the forensic analyst can legally access the encrypted backup contents.

Answer

Performing a logical acquisition via ADB

Answer

Using Cellebrite UFED to force a physical extraction without backup

Question 15

A malware analyst is performing dynamic analysis of a suspicious executable in a Cuckoo Sandbox environment. Which THREE of the following behavioural indicators would be considered suspicious and warrant further investigation?

Accepted Answer

Creating a mutex with a hardcoded name. Creating a mutex with a hardcoded name is a common anti-analysis technique used by malware to ensure only one instance runs, preventing multiple infections or sandbox detection. In Cuckoo Sandbox, a hardcoded mutex name (e.g., 'Global\MyMalwareMutex') can indicate a known malware family or a custom implementation, warranting further investigation as it often correlates with persistence or evasion logic.

Answer

Reading registry keys under HKLM\HARDWARE

Answer

Writing a temporary file to %TEMP%