According to the CHFI v11 Mobile and IoT Forensics domain, rooting an Android device is the most common and direct method used to obtain elevated (superuser) privileges and unrestricted access to system resources. Rooting allows a user to bypass Android’s built-in security restrictions and gain full control over the operating system, including access to protected directories, system binaries, kernel parameters, and hardware interfaces.
CHFI v11 explains that once an Android device is rooted, the user can modify system files, install unauthorized applications, disable security controls, manipulate logs, and conceal malicious activity—making rooting a frequent technique in cybercrime and anti-forensics scenarios. From a forensic perspective, rooting significantly impacts evidence integrity and is often identified through artifacts such as the presence of su binaries, modified boot images, or root management applications.
While installing a custom ROM does modify the operating system, it does not inherently guarantee unrestricted system access unless the device is rooted. Jailbreaking applies specifically to iOS devices, not Android. Exploiting an iOS firmware vulnerability may lead to jailbreaking, but the scenario does not indicate an iOS environment.
CHFI v11 emphasizes that identifying whether a device has been rooted is critical during mobile investigations, as it affects data acquisition methods, trustworthiness of artifacts, and anti-forensic risk assessment .
Therefore, the most likely method used to achieve elevated privileges and unrestricted system access in this scenario is rooting the Android device , making Option C the correct answer.
