Android Device Application Analysis GASF Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a forensic examination of a rooted Android device, you need to recover deleted chat messages from a messaging app. The app stores its data in an encrypted SQLite database within its sandboxed internal storage. You have obtained a full physical image and the device is rooted. Which approach is most likely to yield the deleted messages?

   • AParse the SQLite database's freelist and WAL/SHM files after decrypting the database using keys extracted from the app's shared preferences.
   • BUse the device's backup feature to restore the app data to a second device and then extract the messages from the restored database.
   • CCopy the app's cache directory and parse the cached message previews, which often contain the full text of deleted messages.
   • DRun a file carving tool on the raw image to recover the original database file before it was overwritten by the encryption process.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An examiner is reconstructing a suspect's activities from a travel app and a calendar app. The travel app stores flight bookings in a SQLite database, while the calendar app stores events in a separate SQLite database. Both apps sync to cloud services. The examiner has access to the device and the cloud accounts. Which approach would best reconstruct the suspect's travel timeline?

   • AUse only the cloud data, since it is more reliable than local data.
   • BCorrelate the flight booking timestamps from the travel app with the calendar event times from the calendar app, and verify with cloud-synced data to fill any gaps.
   • CRely on the calendar app's database, since it contains the user's schedule, and ignore the travel app.
   • DUse only the travel app's database, since it contains the flight bookings and is the primary source.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An examiner is trying to recover deleted photos from a gallery app on an Android device. The app stores thumbnails in a SQLite database and full images in external storage. The database has been vacuumed, and the external storage has been partially overwritten. Which technique is most likely to recover the deleted photos?

   • ALook for the deleted photos in the app's cache directory, which often stores full-resolution copies.
   • BParse the SQLite database's WAL file, which may contain the original file paths of the deleted photos.
   • CUse the device's media store database to find the original file paths and then recover them from the filesystem journal.
   • DCarve the external storage for JPEG file signatures and correlate with any remaining thumbnail data in the database's free pages.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a forensic examination of a suspect's Android device, you locate the package directory for a messaging app. The app's SQLite database file appears to have been recently deleted from its original location. Which approach would most likely recover the deleted database content?

   • ARestore the database from the app's cache directory, which typically retains a copy of the last database state.
   • BExtract the database from the app's shared preferences file, which stores a serialized copy of the database for quick recovery.
   • CCarve the database pages from the app's data partition unallocated space and reconstruct the schema from the SQLite header and page map.
   • DUse the app's backup file from Google Drive, which is automatically updated with the latest database state.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic examiner is analyzing a banking app on an Android device. The app uses a SQLite database that is encrypted with SQLCipher. The examiner has root access and can extract the database file, but the encryption key is not stored in shared preferences. The app uses the Android Keystore to protect the key. Which approach is most likely to succeed in decrypting the database?

   • ABrute-force the SQLCipher key by trying common passwords and PINs used by the user.
   • BLook for a backup of the database in the app's cache or external storage that may be unencrypted.
   • CExtract the key from the Android Keystore by dumping the keystore file and decrypting it with the device's hardware key.
   • DUse a Frida script to hook the app's database open function and capture the decrypted key or plaintext data at runtime.
   Reveal Solution Discussion Select an answer first