During an investigation, you need to locate a suspect's downloaded files from a file-sharing app. The app stores downloaded files in its external storage directory. Which location should you examine first?

The device's shared external storage root, such as /sdcard/Download/

The app's cache directory, such as /data/data/ /cache/

The app-specific external storage directory, such as /sdcard/Android/data/ /files/

The app's internal storage directory, such as /data/data/ /

An examiner is investigating a suspect who used a note-taking app that syncs data to a vendor-specific cloud service. The device is available, but the cloud account credentials are not. Which approach would best help the examiner obtain the cloud-synced app data?

Attempt to reset the account password using the device's email account.

Use the device's authentication tokens to access the cloud account directly.

Analyze the app's local cache to reconstruct the cloud data, since the cache contains a full copy.

Issue a legal request to the cloud service provider for the account's data, providing the necessary legal authority.

A forensic examiner is investigating a case involving a suspect's Android device. The suspect used a note-taking app that syncs to a vendor-specific cloud backup. The device is damaged and cannot be powered on. The examiner has legal authority to access the cloud backup. Which step should the examiner take first?

Use the vendor's cloud backup API to restore the data to a new device.

Attempt to repair the device to extract data from its internal storage.

Obtain the cloud backup data from the vendor and parse it for the note-taking app's data.

Search the device's external storage for a local backup of the app data.

During a forensic examination, you find that a suspect used a photo-editing app that stores edited images in a cache directory. The original images were deleted from the gallery, but the cache directory contains thumbnails and edited versions. Which approach would best recover evidence of the deleted images?

Examine the cache directory for thumbnails and edited images, and also carve for deleted image data in unallocated space to recover the originals.

Ignore the cache directory and focus on the unallocated space, since cache files are not reliable evidence.

Rely solely on the cache directory, since it contains all edited images and thumbnails.

Use the app's shared preferences to recover the original image file paths.

In a SQLite database, what does the 'schema' refer to?

The version number of the SQLite library

The actual data rows stored in the tables

The structure of the database, including tables, columns, and indexes

The file path where the database is stored

GIAC Advanced Smartphone Forensics

Domain 3Objective 2

Android Device Application Analysis GASF Practice Questions (Page 5)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21application · medium
During an investigation, you need to locate a suspect's downloaded files from a file-sharing app. The app stores downloaded files in its external storage directory. Which location should you examine first?
Select an answer first
22application · medium
An examiner is investigating a suspect who used a note-taking app that syncs data to a vendor-specific cloud service. The device is available, but the cloud account credentials are not. Which approach would best help the examiner obtain the cloud-synced app data?
Select an answer first
23application · medium
A forensic examiner is investigating a case involving a suspect's Android device. The suspect used a note-taking app that syncs to a vendor-specific cloud backup. The device is damaged and cannot be powered on. The examiner has legal authority to access the cloud backup. Which step should the examiner take first?
Select an answer first
24expert · hard
During a forensic examination, you find that a suspect used a photo-editing app that stores edited images in a cache directory. The original images were deleted from the gallery, but the cache directory contains thumbnails and edited versions. Which approach would best recover evidence of the deleted images?
Select an answer first
25foundation · easy
In a SQLite database, what does the 'schema' refer to?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Android Device Application Analysis GASF Practice Questions (Page 5)

Questions 21–25

During an investigation, you need to locate a suspect's downloaded files from a file-sharing app. The app stores downloaded files in its external storage directory. Which location should you examine first?

An examiner is investigating a suspect who used a note-taking app that syncs data to a vendor-specific cloud service. The device is available, but the cloud account credentials are not. Which approach would best help the examiner obtain the cloud-synced app data?

In a SQLite database, what does the 'schema' refer to?

Keep studying — Mobile Device Application Analysis