A small company is investigating a data breach involving a mobile device used by an employee. The device is a personal smartphone that the employee used for work. The company wants to preserve evidence for potential legal action. Which challenge is most relevant to this scenario?

The device is too old to support modern forensic tools.

The device may contain personal data that is protected by privacy laws.

The device's battery is non-removable, making acquisition difficult.

The device uses a proprietary operating system that is not supported.

A forensic examiner is analyzing a smartphone seized in a fraud investigation. Which of the following are types of evidence that can be recovered from the device? (Select all that apply.)

The device's original purchase receipt

An examiner has a rooted Android device that is powered off. The examiner needs to acquire the device's full flash memory, including deleted data. Which acquisition method is most appropriate?

Physical acquisition via dd over ADB

Backup extraction using the device's built-in backup feature

What is a characteristic of logical extraction?

It only retrieves data that is accessible through the operating system

It requires a physical connection to the device's memory chip

It is the most comprehensive method

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 1

Mobile Forensics CHFI Practice Questions (Page 6)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

13concepts

Questions 26–30

26foundation · easy
Which of the following is a common mobile forensics tool used for data extraction and analysis?
Select an answer first
27application · medium
A small company is investigating a data breach involving a mobile device used by an employee. The device is a personal smartphone that the employee used for work. The company wants to preserve evidence for potential legal action. Which challenge is most relevant to this scenario?
Select an answer first
28application · medium · select all that apply
A forensic examiner is analyzing a smartphone seized in a fraud investigation. Which of the following are types of evidence that can be recovered from the device? (Select all that apply.)
Select an answer first
29expert · hard
An examiner has a rooted Android device that is powered off. The examiner needs to acquire the device's full flash memory, including deleted data. Which acquisition method is most appropriate?
Select an answer first
30foundation · easy
What is a characteristic of logical extraction?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.