CHFI Mobile and Malware Forensics Practice Test 9 — 15 Questions

Question 1

A forensic analyst is examining an Android device using ADB extraction. Which TWO statements about ADB extraction are true?

Accepted Answer

ADB extraction requires USB debugging to be enabled on the device. ADB (Android Debug Bridge) extraction requires USB debugging to be enabled on the device because ADB operates over a USB connection using the Android Debug Bridge protocol, which is only active when USB debugging is turned on in Developer Options. Without this setting, the device will not respond to ADB commands, making extraction impossible. This is a fundamental prerequisite for any ADB-based forensic acquisition.

Answer

ADB extraction allows full file system access without root

Answer

ADB extraction can acquire a physical image of the device

Answer

ADB extraction can recover deleted files from unallocated space

Question 2

A malware sample creates the following registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MalwareName. Which THREE of the following are appropriate next steps for the analyst?

Accepted Answer

Document the registry key as an IoC for future detection. Documenting the registry key as an Indicator of Compromise (IoC) is a fundamental forensic step. The key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run is a standard autostart location, and recording its exact path, value name, and data allows for detection of the same malware on other systems or in future scans, enabling proactive threat hunting.

Answer

Run a full system antivirus scan

Answer

Contact law enforcement immediately

Question 3

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

Accepted Answer

PEiD. PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Answer

Strings

Answer

Ghidra

Answer

IDA Pro

Question 4

During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?

Accepted Answer

Notes app data. The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.

Answer

Call history

Answer

SMS and iMessage conversations

Answer

Keychain data

Question 5

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

Accepted Answer

GrayKey. GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Answer

Oxygen Forensic Detective

Answer

Magnet AXIOM

Answer

Cellebrite UFED

Question 6

A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)

Accepted Answer

Performing strings analysis on the packed binary. Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

Answer

Renaming the file to .txt

Answer

Executing the sample in Cuckoo Sandbox

Question 7

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Accepted Answer

packages.xml file in /data/system/. The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Answer

Full system dump (dd image)

Answer

Wi-Fi connection logs

Answer

SMS database (mmssms.db)

Question 8

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

Accepted Answer

SQLite Browser. SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Answer

GrayKey

Answer

Oxygen Forensic Detective

Answer

Cellebrite UFED

Question 9

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

Accepted Answer

Physical extraction using a JTAG or chip-off technique. Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Answer

Manual extraction through the user interface

Answer

Logical extraction via ADB

Answer

File system extraction

Question 10

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

Accepted Answer

UPX -d. The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer

Ghidra

Answer

Process Monitor

Answer

IDA Pro

Question 11

During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?

Accepted Answer

Advanced logical extraction. C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

Answer

File system extraction

Answer

Physical extraction

Answer

Logical extraction

Question 12

An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?

Accepted Answer

Logical acquisition via ADB backup. The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.

Answer

Manual acquisition through device UI

Answer

Physical acquisition via JTAG

Answer

File system acquisition via dd

Question 13

An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?

Accepted Answer

Timestomping and obfuscation. Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Answer

Packer and anti-debugging

Answer

Rootkit installation and process hiding

Answer

Log wiping and data hiding

Question 14

During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?

Accepted Answer

Network connection to 198.51.100.10:8080. The outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

Answer

MD5 hash of the original malware file

Answer

Mutex name created by the malware

Question 15

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

Accepted Answer

Physical acquisition. Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer

File system acquisition

Answer

Logical acquisition

Answer

Manual acquisition