CHFI Mobile and Malware Forensics Practice Question
During a mobile forensic examination of an iPhone, the examiner wants to acquire the most data possible, including deleted files and unallocated space. Which acquisition type should be used?
⚠ Common exam trap
The CHFI exam often tests the misconception that logical acquisition (Option B) captures deleted data because it includes the iTunes backup, but backups exclude unallocated space and deleted file remnants.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical acquisition
Physical acquisition creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. This is the only method that captures the raw NAND memory, allowing recovery of data from unallocated blocks and slack space that logical and file system acquisitions skip.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File system acquisition
Why it's wrong here
File system acquisition obtains a structured copy of the file system metadata and allocated files, typically through an operating system interface such as AFC or a jailbroken device's file read; it does not image raw NAND blocks. This means unallocated sectors are never read, and deleted files can only be recovered if remnants exist in file system metadata or free space that the OS still exposes. It preserves more context than logical acquisition but falls short of a bit-for-bit forensic image.
- ✗
Logical acquisition
Why it's wrong here
A logical acquisition uses Apple's backup/syncing APIs to extract only active user records such as contacts, messages, call logs, and app data. It cannot access deleted database entries, file slack, swap, or any region outside the logical file abstraction, and it is the most limited in terms of recovering historical artifacts. Because the OS serves the data, the examiner never sees raw storage blocks and cannot validate filesystem-level integrity.
- ✓
Physical acquisition
Why this is correct
Physical acquisition is the only method that produces a bit-for-bit image of the device's storage, including allocated files, deleted file remnants, and unallocated space, by reading the raw NAND or a block device representation. On iPhones this is technically challenging because modern devices implement full-disk encryption and a Secure Enclave; physical imaging is usually feasible only with bootrom exploits (e.g., checkm8 on A7–A11 chips) or decapsulation/chip-off methods. Once acquired, the raw image allows deep data carving and, if decryption keys are available, complete logical recovery.
- ✗
Manual acquisition
Why it's wrong here
Manual acquisition records what is visible on the device's screen through screenshots, video, or photographs while an operator navigates the UI. It recovers no deleted data, unallocated space, or internal storage content, because everything passes through the user interface layer and usually requires operator interaction that changes device state. It is considered a last-resort or supplement method when hardware/software acquisition is impossible, and it is only as complete as the operator's navigation.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.