CHFI Mobile and Malware Forensics Practice Question
An examiner is analyzing an Android device using Cellebrite UFED. The device is locked with a PIN, and the examiner has no PIN. Which acquisition type should the examiner attempt FIRST to maximize data recovery without destroying evidence?
⚠ Common exam trap
EC-Council often tests the misconception that physical extraction is always the best first step for locked devices, but the trap here is that bootloader exploits or physical methods can trigger data wiping or require unlocking, whereas ADB backup is a non-invasive logical method that preserves evidence integrity when USB debugging is enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Logical extraction via ADB backup
When an Android device is locked with a PIN and no PIN is known, a logical extraction via ADB backup is the safest first step. ADB backup (adb backup) can capture app data and system settings without requiring root or unlocking the bootloader, and it does not modify the device state, preserving evidence integrity. This method works if USB debugging was previously enabled, which is common in forensic acquisitions, and it avoids the risk of triggering lockout or data wiping that physical methods might cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Logical extraction via ADB backup
Why this is correct
ADB backup is a logical extraction that communicates with the Android system over USB to create a tar archive of app data and shared storage. Because it works through the running OS rather than requiring physical access to the flash chip, it can succeed on a locked device if USB debugging has already been enabled and the computer's RSA key is authorized. It does not require root, preserves the device's original state, and is a non-invasive first step before attempting more intrusive acquisition.
- ✗
Manual extraction by photographing the screen
Why it's wrong here
Manual extraction by photographing the screen is not a forensic acquisition method because a locked device's display is off or shows only the lock screen, making user data invisible. Even if the examiner could unlock the screen, this approach only documents visible artifacts and cannot recover deleted content, metadata, or data hidden within application sandboxes. It also introduces human error and fails to preserve a verifiable bit-for-bit copy, so it is ineffective for the investigation.
- ✗
File system extraction via ADB root shell
Why it's wrong here
File system extraction via an ADB root shell requires the Android device to be rooted, which production phones usually are not; enabling root typically demands unlocking the bootloader or applying a custom exploit, both of which can wipe data or invalidate the evidence. On a locked device, the examiner cannot authorize the necessary superuser access, and even a successful root shell only provides a logical file-system view, not the full physical storage. This makes it both practically impossible under the scenario and unnecessary if a logical backup is available.
- ✗
Physical extraction using a bootloader exploit
Why it's wrong here
Physical extraction using a bootloader exploit, such as a bootROM vulnerability, is highly invasive and requires either an unlocked bootloader or a device-specific flaw like CheckM8. Triggering the exploit often calls for fastboot commands or custom recovery images that alter the device's partition state, and a failed attempt can corrupt the flash memory or trip security flags, thereby destroying evidence. Because logical methods are safe and may already yield the needed data, examiners should exhaust logical acquisition before risking physical extraction on a locked device.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.