CHFI Mobile and Malware Forensics Practice Question
In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?
⚠ Common exam trap
The CHFI exam often tests the distinction between logical acquisition (adb pull) and physical acquisition (adb shell dd), so the trap here is that candidates confuse the simple file copy command (adb pull) with the raw block-level imaging command (adb shell dd), assuming any command with 'pull' or 'backup' can produce a forensic image.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img
The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
adb pull /data data.img
Why it's wrong here
adb pull /data data.img copies the /data directory tree to a local file using a file-by-file protocol, not a raw bit-for-bit image of the underlying partition. This approach cannot capture deleted files, unallocated space, or filesystem metadata that reside in slack space, and it also operates on a live, mounted filesystem, so the resulting copy is not a forensically consistent snapshot.
- ✓
adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img
Why this is correct
adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img invokes the dd utility on the device to read the raw block device /dev/block/mmcblk0, which typically represents the entire internal storage or eMMC chip. This creates a bit-for-bit physical image that includes all data, including deleted files and unallocated sectors, making it ideal for forensic analysis; in practice, you would often redirect output via adb exec-out to a host rather than write to /sdcard to avoid altering evidence.
- ✗
adb backup -f backup.ab
Why it's wrong here
adb backup -f backup.ab generates a logical application backup using Android's backup transport, capturing app data and settings that each app explicitly chooses to make available. It does not read raw partitions, so it excludes the operating system, system files, deleted data, and unallocated space, and the output is an encrypted or clear-text archive, not a sector-level image.
- ✗
adb install physical.img
Why it's wrong here
adb install physical.img is intended solely for installing Android application packages (APK files) onto a device, not for imaging. The installer expects a valid APK manifest and compiled code; passing a .img file will cause an INSTALL_PARSE_FAILED_NOT_APK error because it cannot interpret raw disk data as an installable application. This command has no forensic acquisition capability whatsoever.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.