Android Device Application Analysis GASF Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An examiner is investigating a deleted file from a note-taking app. The app uses SQLite with a WAL file. The main database shows no trace of the deleted note, but the WAL file contains a record that appears to be the deleted note. However, the WAL file also contains many other transactions. What is the most reliable way to recover the deleted note while preserving the integrity of the WAL?

   • ADelete the WAL file and rely on the main database, since the WAL is only temporary.
   • BForce a checkpoint on the database to merge the WAL into the main database, then recover the deleted note from the main database.
   • CUse the app's cache directory to recover the deleted note, since cache files often contain copies of deleted data.
   • DCreate a forensic copy of the WAL file and parse it with a SQLite recovery tool that can interpret WAL frames, then correlate the recovered record with the main database.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An examiner is analyzing a note-taking app that uses an SQLite database. The user deleted several notes, but the database file still exists. Which technique would most likely recover the deleted note content?

   • AUse the app's cloud backup to retrieve the deleted notes, since backups are updated in real time.
   • BParse the SQLite freelist and inspect the database pages that are marked as free but not yet overwritten.
   • CSearch the database file for the text of the deleted notes using a hex editor, since SQLite stores all data in plaintext.
   • DRestore the database from the app's cache directory, which usually contains a backup of the database.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An investigator is reconstructing a user's activities on the day of an incident. The user has a fitness tracking app, a calendar app, and an email app. The fitness app stores step counts and location in its internal database. The calendar app stores events in a SQLite database. The email app stores emails in a cloud-synced mailbox. Which combination of data sources would provide the most comprehensive timeline of the user's day?

   • AUse only the calendar app's events because they provide a structured schedule of the user's day.
   • BUse only the fitness app's location data because it provides continuous tracking of the user's movements.
   • CCorrelate the fitness app's location data with calendar event timestamps and email timestamps to build a timeline.
   • DUse only the email app's timestamps because they show when the user was actively using the device.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An examiner is analyzing a device where a target app's data is stored in both internal and external storage. The app has requested and been granted the READ_EXTERNAL_STORAGE permission. The examiner has root access. Which statement is true regarding the acquisition of the app's data?

   • AThe examiner must use the app's backup feature to access internal storage, even with root.
   • BThe READ_EXTERNAL_STORAGE permission is required to access the app's internal storage, even with root.
   • CThe app's external storage data is accessible without root, but internal storage requires the app's permission.
   • DRoot access allows the examiner to access both the app's internal and external storage directories without additional permissions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of Android's application sandbox?

   • ATo prevent apps from being uninstalled by the user
   • BTo isolate app data and code from other apps and the system
   • CTo allow apps to share data freely with each other
   • DTo ensure apps can only access the internet through a proxy
   Reveal Solution Discussion Select an answer first