CHFI Mobile and Malware Forensics Practice Question
A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?
⚠ Common exam trap
EC-Council often tests the misconception that USB debugging alone enables full file system extraction, but in reality, USB debugging only provides ADB shell access with limited (shell) user privileges, not the root-level access required for raw partition imaging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device must be rooted
A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The bootloader must be unlocked
Why it's wrong here
Unlocking the bootloader is only a prerequisite for altering boot partitions or installing a custom recovery/rooted image; Oxygen Forensic Detective does not query the bootloader status for its file-system acquisition. In practice, an unlocked bootloader without root still leaves /data and app sandboxes unreadable, and the unlock process generally wipes the userdata partition, which would destroy relevant evidence before imaging. A forensic examiner would therefore avoid unlocking the bootloader for a logical or file-system extraction, since root within the running Android environment is the actual capability the tool relies on.
- ✓
The device must be rooted
Why this is correct
Root access is the decisive prerequisite because Android's kernel sandbox prevents the unprivileged adbd shell user from reading package-private app data, protected system directories, or raw block devices. With root, Oxygen Forensic Detective can execute su or other elevated commands to access /data, application databases, caches, and system partitions, enabling a true file-system extraction. Without root, the tool may still perform a logical extraction of contacts, call logs, and media via public APIs, but the deep application artifacts and deleted-record areas hidden in the file system remain out of reach.
- ✗
The device must be in recovery mode
Why it's wrong here
Recovery mode is not the intended execution context for Oxygen's acquisition workflow; a stock Android recovery image exposes only a limited ADB sideload interface, not a production shell with root filesystem access. Booting into recovery can also alter device state, trigger additional encryption prompts, or invalidate ADB authorizations, making it counterproductive for preserving evidence. Oxygen acquires data while the Android OS is running and usually relies on ADB from the booted system, from which it can escalate privileges if root is present, rather than entering recovery to perform the extraction.
- ✗
USB debugging must be enabled
Why it's wrong here
USB debugging is an enabling, transport-level condition for ADB communication, but it is not sufficient for file-system extraction because the adbd daemon on a non-rooted device runs with shell-level privileges. Even with USB debugging enabled, an examiner cannot read /data or system-protected files unless the ADB connection is later escalated to root; if root is missing, the extraction fails immediately after the shell commands are denied. Thus, USB debugging is merely the doorway into the device, while root is the actual authorization that grants Oxygen the filesystem read access it needs.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.