Option D is the most accurate answer because CHFI v11 explicitly includes Android and iOS forensic analysis , logical and physical acquisition of Android and iOS devices , Android and iOS file systems , and APFS file system analysis as major mobile-forensics objectives.
Android devices are commonly associated in forensic contexts with Ext4-based storage structures , while iOS devices use APFS , which introduces additional complexity due to Apple's security model, sandboxing, and strong encryption protections. That makes iOS extraction and examination more dependent on specialized methods and tools. This matches the CHFI view that mobile platforms require different forensic strategies rather than one uniform method.
Option A reverses the practical situation. B is incorrect because FAT32 is not the shared native forensic file- system answer for both platforms. C contains a partially plausible idea about iOS complexity, but it is less precise and less aligned to the file-system-focused wording than D . Therefore, based on CHFI mobile- forensics objectives, the strongest answer is that Android commonly uses Ext4 , while iOS uses APFS and often requires more specialized forensic handling.

Option A is the best answer because the problem described is a failure to detect the attack in time , which points most directly to a lapse in the SOC's continuous monitoring and analysis function. CHFI v11 explicitly includes the Role of SOC in Computer Forensics , centralized logging using SIEM solutions , incident detection and examination with SIEM tools , and the analysis of network and log data to identify attacks and suspicious behavior.
A SOC's first-line defensive role depends heavily on ongoing visibility into the environment, including network traffic, logs, alerts, and correlations that can reveal malicious activity before major damage occurs. If the attack was only discovered after significant loss, the most likely overlooked function was not primarily evidence preservation or post-incident investigation, but timely monitoring and analysis .
Preserving evidence and maintaining logs are important forensic responsibilities, and the SOC may contribute to investigations, but those do not most directly explain the initial detection failure described in the scenario. Therefore, under CHFI's view of the SOC as part of forensic readiness and incident detection, the strongest answer is continuous monitoring and analysis of network activity .

This question aligns with CHFI v11 objectives under Operating System Forensics and File Type and Encoding Analysis . In digital forensics, file signature analysis-also known as magic number analysis -is a critical technique used to identify the true file type regardless of its extension. Attackers often rename or disguise files to evade detection, making hex-level inspection essential during forensic examinations.
Each file format begins with a unique hexadecimal header that identifies its structure. The hex value "89 50
4E 47" corresponds to the ASCII representation of ‰PNG , which is the standard file signature for Portable Network Graphics (PNG) files. CHFI v11 specifically emphasizes the use of hex editors to analyze file headers and detect file extension mismatches during investigations.
The other options have different signatures: PDF files start with 25 50 44 46 (%PDF) , JPEG files typically begin with FF D8 FF , and BMP files start with 42 4D (BM) . Since the observed hex value matches the PNG signature, the correct identification is PNG. This technique is vital for uncovering hidden or obfuscated evidence and ensuring accurate file classification in forensic investigations.

According to the CHFI v11 Operating System Forensics and Digital Evidence Analysis objectives, The Sleuth Kit (TSK) is a core open-source forensic framework used to analyze disk images and file systems , including NTFS, FAT, EXT, and others. TSK is designed as a modular toolkit , offering both command-line utilities (such as fsstat, fls, and istat) and a plug-in framework that enables structured, extensible analysis.
The fsstat tool is part of this framework and is used to extract file system metadata , including cluster size, inode structure, allocation status, and volume layout-key artifacts required for timeline reconstruction and anomaly detection. CHFI v11 emphasizes that investigators typically analyze disk images using TSK's plug- in-based architecture , which allows multiple forensic modules to operate consistently on the same evidence source without altering it. This architecture is also what enables higher-level forensic platforms (such as Autopsy) to integrate TSK seamlessly.
The other options are incorrect. TSK does not perform network scans , nor does it rely on unstructured manual inspection . While TSK provides APIs for developers, writing custom code is not required for standard disk image analysis and is not the primary method emphasized in CHFI v11.
Therefore, in alignment with CHFI v11, an investigator analyzes disk images using TSK through its plug-in framework , making Option C the correct answer.

This question maps directly to CHFI v11 objectives under Malware Forensics , specifically malware persistence mechanisms and behavior analysis . Persistent malware is designed to survive system reboots and removal attempts by embedding itself into startup locations, registry keys, scheduled tasks, services, boot sectors, or firmware. CHFI v11 emphasizes that identifying persistence mechanisms is a critical step in malware analysis and incident response.
From a forensic perspective, understanding how malware maintains persistence allows investigators to fully eradicate the threat and prevent reinfection. If persistence artifacts are not identified and removed, the malware can continuously reinstall itself, rendering cleanup efforts ineffective and allowing attackers to maintain long-term access. CHFI v11 highlights registry-based persistence, startup folders, services, cron jobs, launch agents, and boot-level persistence as common techniques that must be analyzed.
Additionally, identifying persistence helps investigators reconstruct the attack timeline, understand attacker intent, and determine the scope of compromise. The other options are not primary forensic objectives- system performance, malware geography, or network optimization are unrelated to persistence analysis.
Therefore, in accordance with CHFI v11 malware forensics principles, identifying malware persistence is essential to prevent future infections and ensure the long-term security of the system.