Android Device Application Analysis GASF Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is analyzing a social media app on a rooted Android device. The app stores user messages in its internal database, but the examiner cannot read the database file due to file permissions. Which combination of actions would allow access to the database while preserving evidentiary integrity?

   • AInstall a backup agent on the device that requests the app's data through the Android Backup API.
   • BDisable SELinux temporarily to bypass the sandbox, then copy the database using adb pull.
   • CChange the file permissions of the database to world-readable using chmod, then copy it with adb pull.
   • DUse adb to run 'run-as' with the app's package name to access the app's data directory, then copy the database using a forensic extraction tool.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic examiner is analyzing a banking app on a non-rooted Android device. The app's database is located in its private internal storage, and the examiner cannot access it through normal file browsing. Which method would allow access to the app's database without rooting the device?

   • AUse a file manager app to copy the database from the app's data directory to external storage.
   • BConnect the device to a computer and browse the internal storage using a USB cable, since internal storage is accessible via MTP.
   • CEnable USB debugging and use adb pull to directly copy the database from the app's data directory.
   • DUse the Android Debug Bridge (adb) backup command to create a backup of the app's data, provided the app allows backups.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An examiner is reconstructing a suspect's activities from a fitness app and a social media app. The fitness app stores step counts and GPS tracks in a SQLite database, while the social media app stores check-ins in shared preferences. How can the examiner best correlate these data sources to build a timeline?

   • ACompare the timestamps from the fitness app's GPS tracks with the social media check-in times to identify overlapping locations and times.
   • BUse the fitness app's database to determine the suspect's daily routine, and ignore the social media data as irrelevant.
   • CRely solely on the social media check-ins because they are more reliable than fitness app data.
   • DUse the fitness app's step counts to determine the exact route the suspect took, and the social media check-ins to confirm the destination.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of correlating app data in mobile forensics?

   • ATo reconstruct a timeline of user activity and behavior
   • BTo verify the integrity of the forensic image
   • CTo identify the manufacturer of the device
   • DTo determine the version of the Android operating system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner is analyzing a web browser app on an Android device. The app stores browsing history in a SQLite database and also maintains cache files. Which artifact would be most useful for reconstructing the user's browsing activity?

   • AThe app's log files, which record every user action in detail.
   • BThe cache files, which contain copies of web pages and images that the user viewed.
   • CThe shared preferences file, which stores the user's browser settings and bookmarks.
   • DThe SQLite database containing the browsing history, which includes URLs, visit times, and page titles.
   Reveal Solution Discussion Select an answer first