CHFI Mobile and Malware Forensics Practice Question
An Android device is seized as evidence. The screen is locked with a PIN. Which tool or method is MOST appropriate for acquiring a physical image of the device without bypassing the lock screen, assuming the device is rooted?
⚠ Common exam trap
EC-Council often tests the distinction between physical and logical acquisition methods, and the trap here is that candidates may choose ADB backup (Option D) thinking it is a valid physical acquisition, when in fact it only captures a logical subset of data and cannot recover deleted or system-level artifacts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Boot into recovery mode and use ADB to dd the userdata partition
Booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Boot into recovery mode and use ADB to dd the userdata partition
Why this is correct
Booting into recovery mode bypasses the Android OS and its lock screen, so ADB access does not require user authorization, screen unlock, or USB debugging approval. With a rooted device already granting elevated privileges, issuing dd against the /dev/block/.../userdata path performs a block-level physical acquisition of the entire internal userdata partition, including encrypted blobs or files, which is exactly what the question requires. This method is correct because it captures the full internal storage image without needing to unlock the screen or install any bypass, and it preserves deleted data blocks for forensic analysis.
- ✗
Use Cellebrite UFED with a lock screen bypass exploit
Why it's wrong here
The question specifies acquiring the image without bypassing the lock screen — using a bypass exploit directly contradicts that constraint, regardless of whether one is available. Because the device is already rooted, booting into recovery and imaging with dd requires no bypass at all.
- ✗
Remove the microSD card and image it separately
Why it's wrong here
Removing the microSD card and imaging it separately only targets external removable media, not the device's internal userdata partition where the vast majority of app data, system settings, user files, and forensically relevant artifacts reside. The question explicitly concerns acquiring the image of the Android device's internal storage, and a microSD card is not a substitute for a physical image of the userdata partition. While imaging external SD separately has independent forensic value, it fails to satisfy the requirement of acquiring the internal image, and it does nothing to address the locked screen that limits logical access.
- ✗
Perform an ADB backup to obtain app data only
Why it's wrong here
Performing an ADB backup is a logical acquisition that only extracts SQLite databases, shared preferences, and app-managed files from debuggable apps; it does not capture deleted data, system partitions, or the raw blocks of the internal userdata partition. Moreover, a standard ADB backup command requires the device to be authorized (usually via a confirmation prompt on the screen) and often requires the screen to be unlocked, which is impossible given the locked screen constraint. Even if a backup were possible, it would not meet the requirement to acquire the image of the internal storage, so this option is both technically and procedurally insufficient for forensic physical acquisition.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.