CHFI Mobile and Malware Forensics Practice Question
A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?
⚠ Common exam trap
EC-Council often tests the misconception that a factory reset securely erases all user data, when in reality residual artefacts like authentication tokens can persist in unallocated flash storage due to incomplete overwrite or lack of TRIM execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Google account authentication tokens and cached account data
Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All installed application APK files
Why it's wrong here
APK files are stored as installed packages under /data/app/ (or /mnt/asec for forward-locked apps) and are removed when the userdata partition is reformatted during a factory reset. While deleted blocks could theoretically be carved from unallocated space, modern factory resets on Android invoke discard/TRIM operations that make the original DEX/ODEX code largely unrecoverable. Additionally, APKs are redistributable packages that are identical to the version on the Play Store, so even a recovered APK would lack the forensic value of unique user or account artifacts.
- ✗
Full SMS message history
Why it's wrong here
The full SMS message history resides in the telephony provider's SQLite database (e.g., /data/data/com.android.providers.telephony/databases/mmssms.db), which is entirely contained within the /data partition that a factory reset wipes. SQLite deletions only mark pages as free, so individual message remnants can sometimes be carved from unallocated blocks, but the entire conversation history is very unlikely to survive intact, especially with secure erase or TRIM. Unlike Google account tokens—which can persist in a separate account/key storage mechanism—SMS messages do not have a secondary persistence layer on the device.
- ✓
Google account authentication tokens and cached account data
Why this is correct
Google account authentication tokens and cached account data are written by the AccountManager service to /data/system/users/0/accounts.db and an encrypted credential store; after a factory reset, the /data partition is formatted but the underlying NAND blocks are not necessarily zeroized, allowing forensic recovery of deleted SQLite pages and token blobs. On many Android builds, the primary Google account username and its OAuth token are also cached in the Google Services Framework and can survive in unallocated space or even in a persistent FRP/device-protection partition. This combination of flash-memory remnants plus a designated persistent location makes account tokens the artifact most likely to be recovered after a reset compared to APKs, SMS, or encryption keys.
- ✗
Encryption keys for user data partition
Why it's wrong here
Encryption keys for the userdata partition are managed by the Android Keystore/Keymaster inside the Trusted Execution Environment (TEE) and are never stored as plaintext files in /data or /system. During a factory reset, the device erases the key encryption key from secure world, logically locking the userdata partition and making prior data cryptographically inaccessible. Unlike account tokens that may remain in flash analytics, these keys are deliberately and irretrievably destroyed during the reset, so forensic recovery of the keys is impossible. Even gaining root or chip-off access cannot retrieve them because the TEE is designed to render the keys unrecoverable after a wipe.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.