CHFI Mobile and Malware Forensics Practice Question
An investigator is analyzing an Android device and finds a database file in /data/data/com.whatsapp/databases/msgstore.db. Which type of information is MOST likely stored in this database?
⚠ Common exam trap
EC-Council often tests the distinction between app-specific databases and system-level databases, and the trap here is that candidates confuse msgstore.db with a general-purpose database that might store contacts or location data, when in fact it is strictly for chat message storage within the WhatsApp application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
WhatsApp chat messages
The msgstore.db file in the WhatsApp package directory is the primary SQLite database that stores all WhatsApp chat messages, including text messages, media metadata, and message timestamps. This database is located at /data/data/com.whatsapp/databases/msgstore.db on Android devices and is a key artifact for forensic recovery of WhatsApp conversations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
WhatsApp chat messages
Why this is correct
WhatsApp chat messages are stored in the app's dedicated SQLite database file named msgstore.db, located in /data/data/com.whatsapp/databases/. This database contains a `messages` table that holds the actual text content, sender/receiver identifiers, timestamps, and message types, making it the primary artefact for recovering chat history. Investigators can also recover deleted messages from free pages of the database file, or from the associated WAL/SHM files if present. Therefore, finding msgstore.db directly indicates WhatsApp chat messages as the relevant data.
- ✗
System call logs
Why it's wrong here
System call logs are not persisted in an application-level SQLite database like msgstore.db. On Android, system calls are intercepted by the kernel and can be traced via tools like strace or collected from kernel ring buffers (dmesg), but they are ephemeral and not stored in a per-app database. A forensic image would reveal system call data only in unallocated space or volatile memory, not in the structured WhatsApp database. Hence, the presence of msgstore.db would not be associated with system call logs.
- ✗
GPS location history
Why it's wrong here
GPS location history on Android is maintained by the system and Google Play services through the FusedLocationProvider, with data stored in databases such as `/data/data/com.google.android.gms/databases/phe` or `location_history.db`, not in WhatsApp's msgstore.db. While WhatsApp can send a real-time location pin, that message content is stored in the `messages` table as a shared location, but it does not constitute a device-wide GPS history. The broader location tracking database is separate and under a different package name. Therefore, msgstore.db is not the source for GPS location history.
- ✗
Contact list from the device
Why it's wrong here
The device contact list is managed by the Contacts Provider and stored in the `contacts2.db` database (or `contacts.db` on older versions) under `/data/data/com.android.providers.contacts/databases/`. Although WhatsApp maintains its own sync table for registered contacts, the authoritative contact list remains in the system provider, not in msgstore.db. An investigator would query the Contacts Provider via content://contacts to extract contacts, while msgstore.db is specifically for WhatsApp messages. Thus, contact list data is not what msgstore.db contains.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.