Home ExamRange Practice Tests

CHFI (312-49) Digital Forensics Simulation

In this simulation, you will analyze extracted artifacts from a mobile device. You will learn to identify common file structures and interpret database contents based on real-world Android forensics.

Investigation Scenario

You are a digital forensics investigator assigned to an intellectual property theft case. An employee is suspected of exfiltrating sensitive proprietary designs to a competitor using a company-issued mobile device. The device, a Samsung Galaxy S21 running Android 13, was seized. A full physical acquisition was performed using a UFED device, and the resulting file system extraction is currently being analyzed in your forensic workstation.

Evidence Collected

[SYSTEM LOG] Acquisition Verified. SHA-256 Checksum: MATCHED.
[FILE PARSER] Navigating partition: /data
[FILE PARSER] Path: /data/data/com.android.providers.telephony/databases/
[ARTIFACT DISCOVERED] File Name: mmssms.db
[FILE METADATA] Size: 1.4 MB | Format: SQLite 3 database | Modified: 2023-10-14 08:22:15 UTC
[ARTIFACT DISCOVERED] File Name: mmssms.db-wal (Write-Ahead Log present)
[ARTIFACT DISCOVERED] File Name: mmssms.db-shm (Shared Memory present)

Question

During a mobile-forensics examination of an Android device, an analyst discovers a file named mmssms.db. What type of information is typically stored in this database?

Investigator's Hint: Look closely at the filename itself. The letters "mms" and "sms" refer to specific, highly common cellular communication protocols used for text and media routing.

Expert Analysis

  1. What evidence shows: The extraction pulled a file named mmssms.db along with its associated -wal and -shm files from the Android telephony provider directory (/data/data/com.android.providers.telephony/databases/).
  2. Identify forensic stage: Examination and Analysis (identifying file structures and parsing artifacts to extract readable human communications).
  3. Why correct answer is correct: In the Android OS architecture, the mmssms.db SQLite database is specifically engineered by the telephony provider to store user text messages (SMS) and multimedia messages (MMS). The tables within this database (such as sms, pdu, part) contain the message bodies, sender/receiver numbers, timestamps, and read status.
  4. Why others are wrong:
    • Call logs & contacts: These are typically located in contacts2.db or calllog.db under the com.android.providers.contacts directory.
    • Web history: Found in application-specific databases (e.g., Chrome's History database under com.android.chrome).
    • Location history: Primarily extracted from Google services (e.g., gservices.db) or specific cache files, not the telephony provider.
  5. Real-world forensic action: An investigator would extract mmssms.db along with the Write-Ahead Log (-wal) to ensure deleted or pending transactions are captured. The database would be loaded into a forensic SQLite viewer (like Autopsy or DB Browser for SQLite) to query the sms table, joining it with the contacts2.db to resolve phone numbers to contact names, building a communication timeline.
  6. MINI LESSON:
    Artifact Interpretation & Associated Files: When collecting SQLite databases like mmssms.db, it is vital to maintain the integrity of the surrounding directory. Modern SQLite uses WAL (Write-Ahead Logging). If a forensic examiner only extracts the .db file and ignores the .db-wal file, they risk losing the most recent (and potentially most critical) messages, or even accessing a corrupted state of the database. Always collect the triad: .db, .db-wal, and .db-shm.

Ready to master Digital Forensics?

Enhance your investigative skills with full-scale CHFI practice exams.

Explore more CHFI simulations