CHFI Mobile and Malware Forensics Practice Question
An examiner acquires a full file system image from an Android device running Android 11. While parsing the image, they need to identify which application was used to send a specific SMS message that was deleted shortly after being sent. The device uses Google Messages as the default SMS app. Which artefact location is MOST likely to contain remnants of the deleted SMS content?
⚠ Common exam trap
The trap here is assuming that because Google Messages is a Google app, its data resides in a Google-specific database rather than the standard Android telephony provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The mmssms.db SQLite database in /data/data/com.android.providers.telephony/databases/
SMS messages on Android are stored by the telephony provider in mmssms.db, regardless of which messaging app is used as the default. When a message is deleted, the SQLite record may remain in freelist pages or write-ahead log files until a vacuum operation occurs. The examiner should target this database and attempt carving or journal analysis to recover the deleted content. Other databases serve different purposes and would not contain the SMS body.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The mmssms.db SQLite database in /data/data/com.android.providers.telephony/databases/
Why this is correct
The mmssms.db database stores SMS and MMS messages for the default messaging provider. Even when a message is deleted from the user interface, the underlying SQLite pages may retain deleted records until vacuumed. Google Messages writes to this provider database, so remnants of the deleted SMS can often be carved from freelist pages or recovered via WAL/journal files, making this the most direct artefact for the scenario.
- ✗
The WhatsApp msgstore.db in /data/data/com.whatsapp/databases/
Why it's wrong here
WhatsApp stores its own messages in msgstore.db, but the scenario specifies that Google Messages was the default SMS app. WhatsApp does not handle standard SMS traffic unless the user explicitly uses it for SMS, which is not the case here. Therefore, this database would not contain the deleted SMS in question, and examining it would waste time and potentially miss the actual evidence.
- ✗
The contacts2.db database in /data/data/com.android.providers.contacts/databases/
Why it's wrong here
contacts2.db stores contact and call log information, not SMS message bodies. While it may contain phone numbers, it does not retain the content of text messages. The examiner needs the message text, which is not present in this database. Relying on contacts2.db would fail to recover the deleted SMS content and misdirect the investigation away from the correct telephony provider database.
- ✗
The com.google.android.gms database in /data/data/com.google.android.gms/databases/
Why it's wrong here
Google Play Services databases store account, authentication, and service-related data, not SMS message content. Although Google Messages is a Google app, it uses the standard Android telephony provider for SMS storage, not a Google Play Services database. Searching here would not yield the deleted SMS and would overlook the mmssms.db, which is the actual repository for SMS messages on Android.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.