CHFI Mobile and Malware Forensics Practice Question
During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?
⚠ Common exam trap
EC-Council often tests the misconception that file system acquisition (Option B) can recover deleted data because it extracts the entire file system, but in iOS, the file system extraction does not include unallocated space due to the HFSX/APFS design and sandboxing, making physical acquisition the only method that accesses raw NAND for deleted SMS recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical acquisition via JTAG or chip-off
Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manual acquisition by taking screenshots
Why it's wrong here
Manual acquisition via screenshots captures only the currently rendered UI content, leaving all underlying storage—including deleted messages, database remnants, and unallocated space—inaccessible. It is not a validated forensic method because the examiner relies on human interaction with the device, and any data not visible on screen is permanently missed. This technique cannot recover deleted data and is therefore unsuitable for thorough mobile forensics.
- ✗
File system acquisition via iOS file system extraction
Why it's wrong here
File system acquisition through iOS file system extraction obtains a logical copy of the device's filesystem, typically via AFC or a backup protocol, which yields allocated files and some metadata but does not image the entire physical flash. While it may expose some unallocated space remnants depending on the extraction method, it does not provide a bit-for-bit copy of the NAND storage, so deleted messages or data in unallocated blocks are often lost. The lack of a complete media image means it is less thorough and less reliable for recovering deleted artifacts than physical acquisition.
- ✓
Physical acquisition via JTAG or chip-off
Why this is correct
Physical acquisition via JTAG (Joint Test Action Group) or chip-off directly images the device's raw NAND flash memory, providing a complete bit-for-bit copy of all storage—including allocated, unallocated, and deleted areas. This level of extraction bypasses the operating system's file abstraction layers and allows forensic tools to reconstruct files, including deleted messages, from raw data remnants. JTAG requires hardware-level connections to the device's test ports, while chip-off involves desoldering the memory chip, both yielding the most comprehensive evidence.
- ✗
Logical acquisition via iTunes backup
Why it's wrong here
Logical acquisition via iTunes backup extracts only the files that the iOS backup process chooses to include—typically app data, settings, and media—but it never touches the device's full storage or unallocated space. Because the backup is created at the file level through iOS APIs, deleted records are usually absent, and the backup may not include certain protected or system-level data. This method cannot recover deleted messages or other artifacts that reside in free blocks, making it insufficient for deep forensic analysis.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.