A forensic examiner is investigating a suspect's Android device and finds that the suspect used a third-party backup app to back up app data to Google Drive. Which approach would best help the examiner identify and analyze app data artifacts in the cloud backup?

Use the device's local backup files to reconstruct the cloud backup, since they are identical.

Request the Google Drive backup contents through legal process and compare the backed-up app data with the local app data to identify discrepancies.

Analyze the app's cache files to determine what data was backed up to Google Drive.

Check the app's shared preferences for a backup timestamp and assume the cloud backup contains the same data.

During a forensic review of a ride-sharing app, you find a shared preferences XML file containing a timestamp for the last trip and a cache file with map tiles. How can you best use these artifacts to reconstruct the user's activity timeline?

Use the shared preferences timestamp to determine the user's current location, and the cache file to determine the route taken.

Treat the shared preferences timestamp as the exact time the user requested a ride, and the cache file as proof of the destination.

Correlate the shared preferences timestamp with the cache file's last-modified time and any associated location metadata to place the user at a specific time and place.

Ignore the cache file because it only contains map tiles, and rely solely on the shared preferences timestamp for the timeline.

During a forensic examination, you find that a social media app has a large cache directory. You suspect that the cache contains deleted images that were viewed by the user. Which action is most appropriate to recover these images?

Copy the cache directory and use file carving to recover image files, including those that have been deleted but not yet overwritten.

Clear the cache to ensure the device is clean before analysis.

Ignore the cache because it is only temporary data and has no evidentiary value.

Only analyze the cache if the app's shared preferences indicate that caching is enabled.

GIAC Advanced Smartphone Forensics

Domain 3Objective 2

Android Device Application Analysis GASF Practice Questions (Page 1)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1application · medium
A forensic examiner is investigating a suspect's Android device and finds that the suspect used a third-party backup app to back up app data to Google Drive. Which approach would best help the examiner identify and analyze app data artifacts in the cloud backup?
Select an answer first
2foundation · easy
Which of the following is a common source of cloud-synced app data that a forensic examiner might analyze?
Select an answer first
3foundation · easy
Which Android storage location is typically used for app-specific files that are large or intended to be shared with other apps, and is accessible without root?
Select an answer first
4application · medium
During a forensic review of a ride-sharing app, you find a shared preferences XML file containing a timestamp for the last trip and a cache file with map tiles. How can you best use these artifacts to reconstruct the user's activity timeline?
Select an answer first
5application · medium
During a forensic examination, you find that a social media app has a large cache directory. You suspect that the cache contains deleted images that were viewed by the user. Which action is most appropriate to recover these images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Android Device Application Analysis GASF Practice Questions (Page 1)

Questions 1–5

A forensic examiner is investigating a suspect's Android device and finds that the suspect used a third-party backup app to back up app data to Google Drive. Which approach would best help the examiner identify and analyze app data artifacts in the cloud backup?

Which of the following is a common source of cloud-synced app data that a forensic examiner might analyze?

Which Android storage location is typically used for app-specific files that are large or intended to be shared with other apps, and is accessible without root?

During a forensic review of a ride-sharing app, you find a shared preferences XML file containing a timestamp for the last trip and a cache file with map tiles. How can you best use these artifacts to reconstruct the user's activity timeline?

During a forensic examination, you find that a social media app has a large cache directory. You suspect that the cache contains deleted images that were viewed by the user. Which action is most appropriate to recover these images?

Keep studying — Mobile Device Application Analysis