CHFI Mobile and Malware Forensics Practice Question
In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?
⚠ Common exam trap
The CHFI exam often tests the distinction between tools used for physical device extraction (like Cellebrite UFED or GrayKey) versus those used for password cracking (like Hashcat), and the trap here is that candidates may confuse GrayKey's passcode bypass capability with backup password cracking, even though GrayKey does not use GPU acceleration for brute-forcing encrypted backups.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hashcat
Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Hashcat
Why this is correct
Hashcat is the only listed tool designed for GPU-accelerated offline password recovery, and mode 14700 specifically targets iTunes backup password hashes extracted from Manifest.plist. An examiner converts the encrypted backup metadata into a hash format that Hashcat can attack, then uses dictionary, rule-based, or brute-force attacks on GPUs. This makes it uniquely suited for recovering the backup encryption password when the device passcode is unknown or when legal authority permits an offline attack.
- ✗
Oxygen Forensic Detective
Why it's wrong here
Oxygen Forensic Detective is an all-in-one mobile forensic platform that parses iOS backups, logical extractions, and filesystem images, and it can present encrypted-backup data if the analyst already supplies the password. It does not include a specialized GPU-based password cracking engine for iTunes backup hashes. Its role is data acquisition and analysis, not high-speed offline password recovery, so choosing it for cracking the backup password confuses its analytic workflow with Hashcat's targeted cracking role.
- ✗
Cellebrite UFED
Why it's wrong here
Cellebrite UFED is a forensic acquisition and extraction system that can bypass or remove device passcodes on supported iOS versions using exploit-based methods, and it can acquire encrypted backups from a device or computer. However, it does not perform GPU-based offline cracking of the iTunes backup password; its extraction capability is dependent on supported hardware, firmware, and/or the user knowing the backup password. UFED's 'pin/password bypass' targets the device's lock screen, not the PBKDF2-wrapped keybag in a backup.
- ✗
GrayKey
Why it's wrong here
GrayKey is a standalone law-enforcement hardware appliance used to perform physical extraction of iOS devices, often by exploiting DFU/USB modes to brute-force the device passcode within an access-limit bypass. It is not a password-cracking tool for the encryption key derived from an iTunes backup; it does not offload the PBKDF2 hash to GPUs. Confusing GrayKey's onboard passcode brute-forcing with Hashcat's offline hash attack conflates device acquisition technology with hash-recovery software.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.