Encrypted App Data: Least Likely Recoverable After Factory Reset
A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?
Quick Answer
The answer is encrypted app data from /data/data/, as this is the least likely to be recoverable after an Android factory reset. This is because a factory reset wipes the /data partition and re-encrypts it with a new key, discarding the original file-based encryption (FBE) per-user key that protected app data. Without that original key, forensic tools cannot decrypt the ciphertext, making recovery virtually impossible. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your understanding of Android file-based encryption versus older full-disk encryption, often appearing as a trap where candidates mistakenly choose deleted files or cached thumbnails. Remember, while deleted files may leave residual traces, encrypted data without its key is effectively gone. A useful memory tip: “Key lost, data lost—FBE’s final cost.”
⚠ Common exam trap
The CHFI exam often tests the misconception that a factory reset makes all data permanently unrecoverable, but the trap here is that encrypted data is truly irrecoverable due to key destruction, whereas unencrypted or synced data may still be retrieved from residual storage or cloud sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypted app data from /data/data/
After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Google account tokens stored in AccountManager
Why it's wrong here
Could be recoverable from /data/system/.
- ✓
Encrypted app data from /data/data/
Why this is correct
File-based encryption keys are wiped; data is inaccessible.
- ✗
System logs in /data/log/
Why it's wrong here
Some logs may persist after reset.
- ✗
Deleted text messages from SQLite files
Why it's wrong here
May be partially recoverable from unallocated space.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst is examining an Android device that has been factory reset. Which of the following artefacts is MOST likely to persist after a factory reset and provide valuable evidence?
hard- A.Google account authentication tokens and sync settings
- B.Deleted SMS messages from the mmssms.db WAL file
- ✓ C.The contents of the SD card's Android/data directory
- D.The user's pattern lock hash stored in gatekeeper.password.key
Why C: A factory reset on Android wipes the internal user data partition (/data), which includes accounts.db containing Google authentication tokens and sync settings, as well as gatekeeper.password.key and mmssms.db. However, it does not format the external SD card, so files under Android/data on the SD card remain intact and can provide valuable evidence.
Variation 2. A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?
medium- A.All installed application APK files
- B.Full SMS message history
- ✓ C.Google account authentication tokens and cached account data
- D.Encryption keys for user data partition
Why C: Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.