CHFI Mobile and Malware Forensics Practice Test 9 — 15 Questions

Question 1

A forensic analyst needs to acquire evidence from an iPhone 12 running iOS 15. The device is passcode-locked and cannot be unlocked. Which acquisition method should be used to obtain the MOST data possible?

Accepted Answer

Physical acquisition via GrayKey or Cellebrite. GrayKey and Cellebrite perform physical acquisition by exploiting bootrom or iBoot vulnerabilities (e.g., checkm8 on older devices) or using advanced brute-force techniques to extract the full file system image, including encrypted keychain data and deleted files. This method bypasses the passcode lock and retrieves the maximum amount of data from an iPhone 12 running iOS 15, as logical and manual methods are severely limited by the locked state.

Answer

Logical acquisition via iTunes backup

Answer

Manual acquisition by photographing the screen

Answer

File system acquisition via jailbreak

Question 2

Which Android file system location is MOST likely to contain user-installed app data, preferences, and cached information?

Accepted Answer

/data/data/. The /data/data/ directory on Android devices stores application-specific data for user-installed apps, including preferences (shared preferences XML files), databases, and cached information. This location is part of the internal storage partition and is sandboxed per app, ensuring that each app can only access its own data directory. It is the primary repository for runtime app data, making it the most relevant for forensic analysis of user-installed app artifacts.

Answer

/vendor/

Answer

/system/

Answer

/mnt/sdcard/

Question 3

During a malware analysis, a suspicious executable is detected. The analyst runs `strings` on the binary and finds references to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` and a URL `http://evil.com/beacon`. What does this indicate?

Accepted Answer

The malware establishes persistence and communicates with a remote server. The presence of a registry key reference to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` indicates the malware is configured to launch automatically at system startup, establishing persistence. The embedded URL `http://evil.com/beacon` suggests the malware will make outbound HTTP requests to a remote command-and-control (C2) server for beaconing or data exfiltration. Together, these artifacts confirm persistence and remote communication, making option C correct.

Answer

The malware is a file infector that modifies system binaries

Answer

The malware uses a mutex for synchronization

Answer

The malware performs privilege escalation via a known vulnerability

Question 4

Which tool is specifically designed for dynamic analysis of malware by executing it in a controlled, isolated environment and logging its behavior?

Accepted Answer

Cuckoo Sandbox. Cuckoo Sandbox is the correct answer because it is an open-source automated malware analysis system specifically designed to execute suspicious files in a controlled, isolated environment (a sandbox) and log their behavior, including system calls, file system changes, network traffic, and memory dumps. Unlike static analysis tools, Cuckoo performs dynamic analysis by actually running the malware and observing its runtime actions.

Answer

PEiD

Answer

IDA Pro

Answer

Ghidra

Question 5

A security analyst runs the command `regshot64.exe compare` after executing malware. Regshot reports that the following registry key was created: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate`. Which conclusion is MOST likely?

Accepted Answer

The malware installed a persistence mechanism. The registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate` is a standard Windows Run key, which automatically executes the specified program at user logon. By creating this key, the malware ensures it runs every time the user logs in, establishing persistence. This is a classic persistence mechanism, not an action related to encryption, file deletion, or network changes.

Answer

The malware encrypted the user's documents

Answer

The malware deleted a system file

Answer

The malware modified a network configuration

Question 6

In iOS forensics, which database file typically contains the call history, including incoming, outgoing, and missed calls?

Accepted Answer

call_history.db. In iOS forensics, the call history (incoming, outgoing, and missed calls) is stored in the SQLite database file named `call_history.db`. This database is located within the root domain of the iOS file system (typically under `/private/var/mobile/Library/CallHistoryDB/`) and contains tables such as `call` and `call_history` that record each call's direction, duration, timestamp, and associated contact identifier. The CHFI exam specifically tests this file as the authoritative source for call log evidence.

Answer

Notes.db

Answer

AddressBook.db

Answer

SMS.db

Question 7

A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?

Accepted Answer

Encrypted app data from /data/data/. After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.

Answer

Google account tokens stored in AccountManager

Answer

System logs in /data/log/

Answer

Deleted text messages from SQLite files

Question 8

Which of the following is an example of an anti-forensics technique used to hide malicious activity?

Accepted Answer

Timestomping. Timestomping is an anti-forensics technique that deliberately modifies file timestamps (e.g., MAC times: Modified, Accessed, Created) using tools like `touch` on Linux or `SetFileTime` on Windows. By altering these timestamps, an attacker can hide the true timeline of malicious file creation, modification, or access, thereby evading forensic timeline analysis and making it appear that malicious activity occurred at a different time or was part of legitimate system operations.

Answer

Running a sandbox

Answer

Creating a mutex

Answer

Generating a hash

Question 9

During a malware investigation, you find that a process named `svchost.exe` is making outbound connections to an IP address known to be malicious. What tool would be BEST to capture the network traffic for further analysis?

Accepted Answer

Wireshark. Wireshark is the best tool for capturing and analyzing network traffic because it can intercept packets at the network interface level, allowing you to inspect the full payload and headers of outbound connections from `svchost.exe` to the malicious IP. This enables deep analysis of protocols, data exfiltration attempts, and command-and-control communication patterns, which is essential in malware forensics.

Answer

PEiD

Answer

Process Explorer

Answer

Regshot

Question 10

An analyst extracts an iTunes backup from a Windows computer. The backup contains a file manifest.plist with cryptographic hashes. What is the primary purpose of these hashes in the backup process?

Accepted Answer

To verify the integrity of the backup files. The cryptographic hashes in an iTunes backup's manifest.plist file are used to verify the integrity of the backup files. Each hash corresponds to a file in the backup, allowing the system to detect any corruption or tampering by comparing the stored hash against a newly computed hash of the file data.

Answer

To compress the backup data

Answer

To index the backup for faster searching

Answer

To encrypt the backup files

Question 11

Which tool can be used to extract evidence from Android devices through the Android Debug Bridge (ADB) and is often used for logical acquisition?

Accepted Answer

Cellebrite UFED. Cellebrite UFED (Universal Forensic Extraction Device) is a widely used forensic tool that leverages Android Debug Bridge (ADB) to perform logical acquisition of Android devices. ADB allows the tool to communicate with the device's operating system via USB debugging, enabling extraction of call logs, contacts, SMS, and application data without physical chip-off. This makes it the correct choice for logical acquisition over ADB.

Answer

PEiD

Answer

Cuckoo Sandbox

Answer

GrayKey

Question 12

In static malware analysis, what is the purpose of using a tool like PEiD?

Accepted Answer

To detect packers or compilers used in the PE file. PEiD is a static analysis tool that identifies packers, cryptors, and compilers embedded in Portable Executable (PE) files by scanning for known signatures in the file's entry point and section headers. This helps an analyst understand whether the malware is packed (obfuscated) and what tool was used to create or compress it, which is critical before attempting dynamic analysis or unpacking.

Answer

To monitor registry changes during execution

Answer

To disassemble the binary into assembly code

Answer

To analyze network traffic generated by the malware

Question 13

A forensic analyst is examining an Android device for evidence of a specific app's usage. Which TWO locations are MOST likely to contain app-specific data that can be recovered through a logical acquisition?

Accepted Answer

/data/data/. Option B is correct because /data/data/ is the primary directory on Android devices where installed applications store their private data, including databases, shared preferences, and cache files. This directory is accessible through logical acquisition (e.g., ADB backup) and contains app-specific evidence such as user credentials, chat logs, and configuration files.

Answer

/system/bin/

Answer

/proc/

Answer

/init.rc

Question 14

During dynamic analysis of a malware sample, an analyst observes the following: creation of a mutex named `Global\{9A2D7E1C-3F4B-4A5E-9B8C-1D2E3F4A5B6C}`, a registry key under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` named `WindowsUpdate`, and outbound TCP traffic to `203.0.113.5:443`. Which THREE of the following indicators of compromise (IoCs) should be documented?

Accepted Answer

Outbound TCP to `203.0.113.5:443`. Option A is correct because outbound TCP traffic to a specific IP address and port (203.0.113.5:443) is a classic network-based indicator of compromise (IoC). During dynamic analysis, this demonstrates the malware's command-and-control (C2) communication, often using HTTPS over port 443 to blend with legitimate traffic. Documenting this IoC allows defenders to block the endpoint and detect similar infections via network monitoring.

Answer

SHA256 hash of the malware sample

Answer

File path `C:\Windows\System32
otepad.exe`

Question 15

An incident responder is analyzing a compromised Windows workstation. Which TWO artifacts would provide the STRONGEST evidence of a malware persistence mechanism?

Accepted Answer

Registry Run key referencing a suspicious path. The Registry Run key (e.g., `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) is a classic and widely used persistence mechanism. A suspicious path under this key directly indicates that the malware is configured to execute automatically at user logon, providing strong evidence of persistence. This is a core artifact in Windows forensics for identifying auto-starting malware.

Answer

Event log entry for user login

Answer

Network share access logs

Answer

Browser history showing download of a suspicious file