CHFI Mobile and Malware Forensics Practice Question

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

⚠ Common exam trap

EC-Council often tests the misconception that a factory reset securely erases all data, when in fact it only removes filesystem pointers, leaving the underlying data recoverable until overwritten.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

User data such as photos and contacts

After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The GUID Partition Table (GPT)
Why it's wrong here
The GUID Partition Table is a disk partitioning scheme that defines the layout of logical partitions on the storage medium, storing entries for each partition's start, end, type, and attributes. It does not contain user files or any file-level data; it merely describes where partitions like userdata are located. A factory reset neither removes nor rewrites the GPT, so it has no bearing on recoverable user data. Thus, while GPT metadata may persist, it is not a source of recoverable photos or contacts.
✗
The device's encryption keys
Why it's wrong here
Android's file-based encryption (FBE) relies on per-file keys, which are randomly generated during provisioning and typically wrapped with a hardware-bound key from the Trusted Execution Environment (TEE). A factory reset commonly invokes a 'crypto erase' that discards the key-wrapping key, rendering the filesystem cryptographically unrecoverable even if the raw blocks remain intact. Therefore, the encryption keys themselves are not user data and, in fact, are usually intentionally destroyed during reset, making them a specifically wrong choice for recoverable content.
✗
The Android OS system files
Why it's wrong here
The system partition holds the operating system image, including framework, kernel modules, and pre-installed applications, and is mounted as read-only in normal operation. Factory resets do not format or alter the system partition; they only clear the userdata and cache partitions, leaving system files untouched and recoverable but entirely irrelevant to user-generated content. The question targets data created by the device's user, not the shipped OS components, so system files are neither wiped nor a source of recoverable personal data.
✓
User data such as photos and contacts
Why this is correct
A factory reset in Android formats the userdata partition by deleting its ext4 or f2fs metadata and marking blocks as free, but it does not necessarily overwrite the underlying sectors on the flash storage. Forensic examiners can therefore carve files from unallocated space using techniques like file signature carving, and if the device's encryption was disabled or the cryptographic keys can be derived/reset, data like photos and contacts may be reconstructed. This is precisely why the examiner should focus on residual user data in unallocated space after a reset.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question