CHFI Mobile and Malware Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  /data/media/0/Android/data/com.whatsapp/

  Why this is correct

  This path is the app-specific external storage directory for WhatsApp on shared storage, exposed via FUSE and sometimes accessible to forensic tools even without root. It holds user-visible artifacts such as transmitted images, videos, voice notes, and document files, and may also contain encrypted database backups (e.g., msgstore.db.crypt14) that, when credentialed or decrypted, can reveal message history. In a logical acquisition, this location is a priority because it often survives app data clearing and can corroborate messages recovered from the internal database. It is correct because it is a designated app-owned location on external media where WhatsApp materializes attachments with metadata like file names and timestamps.

• ✗

  /data/data/com.android.providers.telephony/databases/mmssms.db

  Why it's wrong here

  This file is the SQLite database for the Android Telephony (SMS/MMS) provider, holding system short message service and multimedia message records. It belongs to the com.android.providers.telephony package and is unrelated to WhatsApp's proprietary messaging data, which lives in the app's own sandbox under /data/data/com.whatsapp. While this database is valuable for SMS/MMS forensics, it cannot contain WhatsApp message content, so it is wrong for a WhatsApp message-history request. Moreover, accessing it typically requires root, but even root access won't yield WhatsApp threads from this database.

• ✓

  /data/data/com.whatsapp/databases/msgstore.db

  Why this is correct

  This is the primary SQLite database within WhatsApp's private internal storage, directly containing message rows, chat metadata, and sender/receiver identifiers. It is the authoritative source for message content, and deleted messages may be recoverable from unallocated database pages or from the write-ahead log (msgstore.db-wal) if the application crashed or was not cleanly checkpointed. Because the app sandbox is protected by SELinux and requires root or a forensic image with an unlocked bootloader to access, this path is a high-value target in physical or full-file-system acquisitions. It is correct because it directly answers the question of recovering WhatsApp message history, including threads and attachments references.

• ✗

  /data/data/com.whatsapp/files/Avatars/

  Why it's wrong here

  This directory stores contact profile pictures (avatars) that WhatsApp downloads and caches for the user's address book, not message content. It exists under the app's internal files directory and reflects contact metadata and image files, but it contains no text messages, timestamps of message transmission, or chat records. An examiner might extract avatars for identification purposes, but they are irrelevant for reconstructing conversation history. Therefore, this is an incorrect choice when the goal is to recover WhatsApp messages.

• ✗

  /data/data/com.google.android.gms/databases/

  Why it's wrong here

  This path belongs to Google Play Services, a system component that handles account synchronization, location,, and other background functions. Its databases contain DroidGuard, Google account metadata, and cached Play Services data, but they do not store application-specific message histories for third-party apps like WhatsApp. While some forensic tools parse these databases for device usage or app-install records, they are not a source for WhatsApp message content. Choosing this option would be a false positive because WhatsApp messages are sandboxed in the app's own package directory, not in shared Google framework databases.

Go deeper

Related to this question