Android Device Application Analysis GASF Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   During an investigation, you need to determine which apps were used to access a specific file on an Android device. The file is stored in the device's shared external storage. Which data sources would be most useful for this analysis?

   • AExamine the apps' shared preferences and cache directories for references to the file, and correlate with the file's access timestamps.
   • BCheck the Android system's activity log, which records all file accesses by apps.
   • CUse the app's internal databases, which store a history of all files accessed by the app.
   • DOnly examine the file's last accessed timestamp, as it directly indicates which app accessed it.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An examiner is investigating a suspect's Android device. The suspect used a note-taking app that syncs to Google Drive. The device has been factory reset, but the examiner has obtained a forensic image of the device's internal storage taken before the reset. The examiner also has legal access to the suspect's Google Drive account. Which approach is most likely to recover the notes?

   • AAnalyze the Google Drive account for the app's synced data and correlate it with any remnants of the app's database found in the forensic image.
   • BOnly analyze the forensic image for deleted database files, since the cloud data may be incomplete.
   • CAttempt to recover the notes from the device's cache partition, which may contain recent versions of the notes.
   • DUse the Google Drive API to search for deleted files, but only if the app used the Drive API directly.
   Reveal Solution Discussion Select an answer first