CHFI Mobile and Malware Forensics Practice Question
Which tool is specifically designed for performing physical extraction of iOS devices and is widely used by law enforcement for bypassing passcode restrictions on modern iPhones?
⚠ Common exam trap
The CHFI exam often tests the distinction between general-purpose forensic suites (like Cellebrite UFED or Magnet AXIOM) and specialized hardware tools (like GrayKey) that are purpose-built for iOS passcode bypass, leading candidates to choose a familiar name like Cellebrite instead of the correct specialized tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GrayKey
GrayKey is specifically designed for physical extraction of iOS devices, leveraging advanced techniques to bypass passcode restrictions on modern iPhones, including those with Secure Enclave and full-disk encryption. It is widely adopted by law enforcement for its ability to perform brute-force attacks on the device's passcode without triggering the auto-wipe feature, making it the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cellebrite UFED
Why it's wrong here
Cellebrite UFED is an all-purpose mobile forensic extraction workstation compatible with thousands of device models and OS versions, offering logical, file-system, and physical acquisition modes. While its physical acquisition can recover data from some iOS devices, it relies on device-specific exploits and often requires the passcode to be known or the device to be jailbroken. GrayKey, by contrast, is a dedicated hardware appliance designed specifically for iOS physical extraction and passcode bypass through secure enclave attacks, which makes it the more specialized tool for this task.
- ✓
GrayKey
Why this is correct
GrayKey is a purpose-built hardware/software appliance engineered exclusively for iOS forensic physical extraction and passcode bypass. It connects to the device's Lightning port and performs automated brute-force attacks against the passcode, including techniques that leverage the device's secure enclave vulnerabilities to allow full filesystem acquisition. This focused capability, combined with high success rates on passcode-protected iPhones, is precisely why law enforcement agencies deploy GrayKey rather than general-purpose mobile tools for physical extraction.
- ✗
Magnet AXIOM
Why it's wrong here
Magnet AXIOM is a digital forensic investigation platform that consolidates artifacts from computers, cloud services, and mobile devices into a unified analysis interface. It does not perform direct physical extraction of iOS devices; instead, it imports acquisition files (such as logical or filesystem images) created by external tools, or uses ADB-based acquisition on Android. Because it lacks any integrated hardware passcode-bypass mechanism, it cannot be considered a dedicated iOS physical extraction tool.
- ✗
Oxygen Forensic Detective
Why it's wrong here
Oxygen Forensic Detective is a feature-rich mobile forensic software suite that supports over a thousand device models and offers advanced logical, file-system, and even some physical data extraction through vendor-specific methods. However, its iOS acquisition capabilities are constrained by Apple's security model, and it does not include specialized hardware or keychain-bypass exploits for brute-forcing a locked device. GrayKey's exclusive focus on iOS hardware-level extraction and passcode attack distinguishes it as the tool specifically designed for this physical extraction scenario.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.