CHFI Mobile and Malware Forensics Practice Question

In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?

⚠ Common exam trap

EC-Council often tests the misconception that 'file system acquisition' is the most thorough because it includes system files, but the trap is that physical acquisition alone captures unallocated space and deleted data, which file system acquisition cannot access due to iOS sandboxing and file system abstraction.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Physical acquisition

Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
File system acquisition
Why it's wrong here
File system acquisition operates at the logical layer by issuing API calls to the mounted file system, so it only returns currently allocated files that the OS permits the agent to see. It completely bypasses unallocated clusters, slack space, and deleted file remnants, which are critical for recovering evidence in mobile forensics. Because it relies on the resident file system metadata rather than imaging the raw NAND flash, it cannot guarantee preservation of all potential evidence and therefore fails the integrity requirement.
✓
Physical acquisition
Why this is correct
Physical acquisition creates a bit-for-bit, forensically sound image of the entire flash memory chip, including unallocated sectors, deleted file fragments, file system slack, and even data remnants from previous partitions. This method is the only approach that preserves the full forensic data set without relying on the device's operating system to filter or sanitize the output. By capturing the complete NAND image, it maximizes data integrity and completeness, making it unequivocally the correct choice for a preservation-focused acquisition.
✗
Logical acquisition
Why it's wrong here
Logical acquisition extracts only file-system metadata and allocated user data, bypassing the device’s unallocated storage space and keychain-protected artefacts. For an iOS device, this fails the stem’s demand for maximum data integrity and completeness because it cannot capture deleted files, system logs, or encrypted authentication tokens that a physical or advanced forensic extractions (e.g., checkm8-based) would retrieve. It is tempting because logical acquisition is non-invasive, fast, and works on locked devices via iTunes backups, making it the correct choice when the goal is rapid triage of visible user content without altering the device state.
✗
Manual acquisition
Why it's wrong here
Manual acquisition involves a forensic examiner physically navigating the user interface, taking screenshots, or photographing the screen to record visible content. It is highly subjective, inherently incomplete, and prone to human error because it only captures data as presented by the OS and cannot access hidden, deleted, or deleted-but-recoverable data. Moreover, the act of tapping through menus can update access timestamps or trigger network activity, potentially altering the device state and compromising evidentiary integrity.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question