CHFI Mobile and Malware Forensics Practice Question

An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?

⚠ Common exam trap

The CHFI exam often tests the distinction between logical and physical acquisition by presenting a command that looks like it might be low-level (e.g., containing 'backup' or 'all') but is actually a logical method, leading candidates to mistakenly choose physical or file system acquisition.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Logical acquisition via ADB backup

The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Manual acquisition through device UI
Why it's wrong here
Manual acquisition through the device user interface (UI) involves an examiner physically tapping through settings, developer menus, or manufacturer-specific sync software to export data, relying on human interaction rather than automated tooling. In contrast, `adb backup` is a non-interactive command-line directive that triggers Android's backup manager over a USB debugging connection, automating a logical extraction without any touch input. The two methods diverge both in their automation and in their evidentiary workflow, making the UI-based description incorrect for this ADB-issued command.
✗
Physical acquisition via JTAG
Why it's wrong here
JTAG (Joint Test Action Group) acquisition is an invasive hardware technique that uses a test access port to directly read raw NAND flash memory, providing a physical bit-for-bit image independent of the Android operating system. It requires physically connecting to the device's circuit board and is not triggered by any ADB command such as `adb backup`. In this scenario, the examiner is using ADB, a software debug bridge, so JTAG is categorically inapplicable.
✓
Logical acquisition via ADB backup
Why this is correct
`adb backup` is a logical acquisition method because it leverages Android's Backup Service to request that each app's internal data, settings, and databases be serialized into a single .ab archive, excluding hidden regions and unallocated clusters. This high-level extraction is governed by the app's `backupAgent` and the device's backup policy, meaning some apps may opt out entirely or omit sensitive files. Unlike a physical or file system image, it yields no deleted remnants or raw partitions—so while it is a valid ADB-based forensic export, it does not produce a bit-for-bit copy of the storage medium.
✗
File system acquisition via dd
Why it's wrong here
The `dd` command is a Unix/Linux tool that, when executed with root privileges on an Android device over ADB, can perform physical acquisition by copying raw bytes from a block device like `/dev/block/mmcblk0` into a flat image file. This process captures the entire storage, including unallocated space, and is fundamentally different from Android's Backup Service, which extracts only allocated application data at a higher logical level. Since `adb backup` does not read block devices or require root access, it cannot be classified as file system acquisition via `dd`.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question