CHFI Mobile and Malware Forensics Practice Question
During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?
⚠ Common exam trap
EC-Council often tests the distinction between device-level encryption (hardware UID) and iCloud backup encryption (passcode-derived keys), and the trap here is confusing SQLCipher (a third-party tool) with Apple's proprietary iOS Data Protection framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.
IOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.
Why it's wrong here
The hardware UID is indeed an integral component of iOS Data Protection, but it is not the sole key material. The effective decryption key is a blend of the UID (from the Secure Enclave) and a passcode-derived key, so possessing the passcode—or a forensic tool that can leverage the passcode—allows decryption without Apple’s involvement. Therefore, the claim that decryption is impossible without Apple's assistance is incorrect.
- ✗
The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.
Why it's wrong here
Apple’s FileVault is a full-disk encryption feature for macOS, not iOS. iOS protects file data with its own Data Protection mechanism, which uses per-file keys wrapped by class keys that are themselves entangled with the device's UID and the user's passcode. The user's iCloud password is used for iCloud services and backup encryption, not for directly decrypting locally stored Health data, so this option misidentifies both the technology and the necessary credential.
- ✗
The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.
Why it's wrong here
SQLCipher is a third-party encryption layer for SQLite databases, but Apple's HealthKit store is not encrypted with SQLCipher; it relies on iOS Data Protection at the file-system layer. While the Keychain can hold encryption keys, the specific claim of a 256-bit SQLCipher key stored there mischaracterizes how Health data is protected. The actual protection is enforced by Data Protection class keys derived from the passcode and UID, not by a static third-party database key.
- ✓
The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.
Why this is correct
This is correct: iOS Health data is stored in HealthKit and protected by iOS Data Protection using a per-file key wrapped by a class key that depends on the device's UID and the user's passcode. The passcode is the critical user-supplied secret; without it, decryption typically requires a forensic bypass tool that can brute-force or otherwise recover the passcode, or leverage a trusted pairing/escrow keybag when available. Apple cannot simply decrypt the data because the passcode is not known to them.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.