CHFI Mobile and Malware Forensics Practice Question
A forensic analyst receives a mobile device that has been factory reset. Which of the following types of data is MOST likely to be recoverable using advanced forensic techniques?
⚠ Common exam trap
EC-Council often tests the misconception that a factory reset is equivalent to a secure wipe, but in reality, it only deletes file pointers and leaves residual data in unallocated flash memory, which advanced forensic techniques can recover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Google account tokens and cached credentials
A factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deleted text messages and call logs, but not app data
Why it's wrong here
Deleted text messages and call logs, but not app data is wrong because after a factory reset, all user content on the encrypted userdata partition becomes inaccessible regardless of file type. SMS/MMS and call logs reside in SQLite databases under /data, the same fully encrypted area as app data, so there is no selective recovery path that would leave those databases recoverable while app data is not. The reset destroys the Data Encryption Key (DEK) wrapping the partition, making every file equally unrecoverable.
- ✗
All user data, as factory reset only deletes file pointers
Why it's wrong here
The claim that all user data survives because factory reset only deletes file pointers reflects an older, unencrypted storage model. On modern devices with file-based encryption (FBE) or full-disk encryption (FDE), the reset invalidates the key hierarchy: the per-user and per-file keys are deleted or unwrapped, so even though raw flash blocks and file metadata may remain, they are cryptographically gibberish. Simply reconstructing file pointers would yield ciphertext, not usable plaintext data.
- ✓
Google account tokens and cached credentials
Why this is correct
Google account tokens and cached credentials can remain recoverable because they are not always stored solely in the encrypted userdata partition. Some authentication tokens are cached in reserved flash areas, NVRAM, or the TrustZone secure world, which the factory reset routine may not fully overwrite. Advanced physical forensics, such as chip-off imaging and JTAG extraction, can recover these residual token blobs, and if combined with a known or brute-forced key, they may allow account access even though normal app and media data is destroyed.
- ✗
No data is recoverable after a factory reset on modern devices
Why it's wrong here
The assertion that no data is recoverable after a factory reset on modern devices is an overgeneralization. Recovery depends on whether encryption was enabled at all, whether the key is stored in hardware that persists (e.g., an OTP region or secure element counter), and whether a weak lock-screen passcode allows offline brute-force of the key wrapping material. Additionally, some system areas like NVRAM, secure logging buffers, and the reboot reason block are not always wiped, so absolute statements of unrecoverability are forensically unsound.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.