CHFI Mobile and Malware Forensics Practice Question
During a mobile forensics investigation, an examiner needs to acquire data from an iPhone running iOS 14. Which of the following acquisition methods provides the MOST complete data extraction?
⚠ Common exam trap
EC-Council often tests the misconception that jailbreak-based file system acquisition is the most complete method, but physical acquisition (JTAG/chip-off) is technically superior because it captures the entire raw storage, including areas the OS hides or encrypts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Physical acquisition via JTAG or chip-off
Physical acquisition via JTAG or chip-off provides the most complete data extraction because it captures a bit-for-bit copy of the raw NAND flash memory, including deleted files, unallocated space, and system partitions that are otherwise inaccessible. On iOS 14, Apple's security features (e.g., full-disk encryption, SEP) limit logical and file system methods, but physical techniques bypass the operating system to retrieve the entire storage image, albeit with decryption challenges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
File system acquisition via jailbreak
Why it's wrong here
File system acquisition via jailbreak requires bypassing iOS code signing and often relies on tools like checkra1n or unc0ver to install a post-exploitation agent that reads the filesystem using a logical mount of the root partition. This approach yields more data than a logical backup, including app containers and some system paths, but it operates through the OS kernel and therefore cannot create a complete bit-for-bit image of raw NAND flash. It also misses deleted file remnants, unallocated space, and areas such as the boot partition or secure enclave, so it remains an intermediate tier that must not be confused with physical imaging.
- ✗
Manual acquisition by browsing the device
Why it's wrong here
Manual acquisition by browsing the device involves using the device's own user interface to navigate visible apps, messages, photos, and settings, often capturing screenshots or reading data aloud. This method is inherently artifact-dependent and only records what the operating system renders through the user interface, so it completely misses deleted records, hidden files, database slack space, and any data residing in system or app-private directories that are not user-facing. It is the least forensically sound because it alters no data? actually it can change metadata by opening content, but importantly it provides no hash verification and no timeline integrity; it is suitable only as a triage step, never as a complete forensic acquisition.
- ✓
Physical acquisition via JTAG or chip-off
Why this is correct
Physical acquisition via JTAG or chip-off is the gold standard for mobile forensic imaging because it accesses the raw NAND/eMMC storage controller directly, independent of the device's operating system. JTAG exploits the Joint Test Action Group debug port to force the CPU to dump memory, while chip-off removes the memory chip and reads it with a programmer; both produce a complete bit-for-bit forensic image, including deleted data, unallocated clusters, and partially overwritten file remnants that would be unavailable through any logical method. This approach preserves the entire chip's contents and allows advanced data recovery, though it requires skill, may destroy the device during chip removal, and must be performed with proper anti-static and bitstream-level hashing procedures.
- ✗
Logical acquisition via iTunes backup
Why it's wrong here
Logical acquisition via iTunes backup uses Apple's native backup protocols to synchronize and pack user data (camera roll, messages, app data, call logs) into a journaled backup directory on the host computer. This process only extracts files that the iOS API exposes and that the backup daemon is authorized to access, so it systematically excludes system files, deleted SQLite records, unallocated storage, and many artifacts hidden in protected container directories. Because logical acquisition passes through the OS's own backup engine, it also preserves the HFS+/APFS metadata in a limited manner and often yields only plist/DB files that are subject to Cocoa serialization, making it less complete than file system acquisition and far less comprehensive than physical imaging.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.