CHFI Mobile and Malware Forensics Practice Question

During a mobile device investigation, an examiner needs to acquire the maximum amount of data from a locked iOS device without modifying it. Which acquisition type should be used?

⚠ Common exam trap

EC-Council often tests the misconception that logical acquisition is sufficient for locked devices because it can extract backups, but the trap is that logical acquisition still requires the device to be unlocked or have a trusted relationship established, whereas physical acquisition is the only method that can bypass the lock screen to capture the entire storage image.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Physical acquisition

Physical acquisition is the correct choice because it creates a bit-for-bit copy of the entire flash storage, including the operating system, user data, and deleted file remnants, without relying on the iOS operating system to be unlocked or cooperative. This method bypasses the lock screen by exploiting hardware or software vulnerabilities (e.g., checkm8 bootrom exploit) or using advanced forensic tools (e.g., Cellebrite, GrayKey) to read the raw NAND memory, ensuring maximum data extraction while maintaining forensic integrity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Manual acquisition
Why it's wrong here
Manual acquisition is performed by the examiner physically interacting with the device's screen and UI to photograph, type, or navigate through content. It demands that the device be unlocked and fully operational, which is impossible on a locked device without the passcode or a bypass exploit. Additionally, this method captures only visible, allocated data and introduces a high risk of altering the device state, making it unsuitable for preserving evidentiary integrity.
✓
Physical acquisition
Why this is correct
Physical acquisition is the most comprehensive forensic method, creating a bit-for-bit image of the device's raw flash memory. This allows recovery of deleted files, unallocated space, and hidden partitions that logical or file system methods would miss. On locked devices, specialized tools like GrayKey or Cellebrite UFED leverage hardware or bootrom exploits (e.g., checkm8) to bypass the lock screen and extract the full memory image without needing the user's passcode. Because it operates below the operating system layer, physical acquisition is the only method that can fully preserve and recover data from a locked device.
✗
Logical acquisition
Why it's wrong here
Logical acquisition relies on the device's high-level APIs, such as backup protocols (iOS) or sync protocols (Android) to request data through the operating system. On a locked device, the OS enforces authentication and denies these requests, so the examiner cannot retrieve even the basic allocated files. Even when the device is unlocked, logical acquisition retrieves only the data in accessible, allocated files, completely missing deleted records, unallocated clusters, and other forensic artifacts that are essential for a thorough investigation.
✗
File system acquisition
Why it's wrong here
File system acquisition targets the filesystem abstraction layer (e.g., APFS, ext4) to read both allocated and recently deleted files by parsing directory entries and inodes. However, on locked devices, the filesystem is typically encrypted via full-disk or file-based encryption, meaning without the decryption key, the examiner cannot interpret the raw data even if it is accessible. Moreover, this method does not capture unallocated blocks or slack space, which often contain remnants of deleted information, making it insufficient for complete recovery on a locked device.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question