Android Device Application Analysis GASF Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An examiner is analyzing a chat app that uses a SQLite database with WAL mode enabled. The database file is intact, but the WAL file has been deleted. The examiner needs to recover recent messages that may only exist in the WAL. Which approach is most likely to recover the messages?

   • AOpen the database in a SQLite browser and look for the messages in the main database file.
   • BCheck the app's shared preferences for a backup of the recent messages.
   • CUse the database's journal file, which contains a rollback journal of recent changes.
   • DCarve the unallocated space of the filesystem for SQLite WAL frames, which contain the recent transactions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an investigation, you find that a suspect used a secure messaging app that stores messages in an encrypted SQLite database. The database file is intact, but the encryption key is not available. Which technique could potentially recover message content?

   • AUse a brute-force attack on the database to guess the encryption key.
   • BAnalyze the database's WAL file, which may contain unencrypted data remnants.
   • CSearch the device's memory (RAM) for the encryption key, which may be cached by the app while it is running.
   • DRecover the key from the app's shared preferences, which often stores encryption keys in plaintext.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an investigation, you need to determine which Wi-Fi networks a user connected to recently. The device has a Wi-Fi manager app that stores connection logs in shared preferences and a separate network diagnostics app that stores logs in its cache. Which approach would provide the most reliable evidence of recent Wi-Fi connections?

   • ACheck the device's external storage for a backup of the Wi-Fi manager app's data.
   • BUse the Android system's Wi-Fi connection logs stored in the system database, which are always the most accurate.
   • CExamine the Wi-Fi manager app's shared preferences for saved network names and timestamps, and correlate with the diagnostics app's cache logs.
   • DOnly analyze the diagnostics app's cache because it is updated frequently and contains the most recent connection data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An examiner is analyzing an Android device from a suspect. The device has a cloud backup enabled for a messaging app. The examiner wants to recover deleted messages that may have been backed up to the cloud. Which action is most appropriate?

   • AExtract the backup file from the device's internal storage using root access and parse it locally.
   • BDisable the device's network connection and attempt to intercept the backup traffic during the next sync.
   • CUse the device's backup and restore feature to restore the cloud backup to the same device and then extract the data.
   • DObtain legal authority and request the cloud backup data from the service provider, then restore it to a controlled environment for analysis.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic examiner is analyzing a social media app's SQLite database. The database contains a table with user posts, and some posts have been deleted. The examiner notices that the database file has free pages that contain remnants of the deleted posts. However, the database also has a WAL file that contains recent transactions. Which approach would best recover the deleted posts?

   • AOnly examine the free pages in the main database, since the WAL file is not relevant to deleted data.
   • BParse the free pages in the main database and also examine the WAL file for any frames that may contain the deleted posts, then correlate the recovered data.
   • COnly examine the WAL file, since it contains the most recent data and likely includes the deleted posts.
   • DRestore the database from the app's backup file, which contains a copy of the deleted posts.
   Reveal Solution Discussion Select an answer first