Android Device Application Analysis GASF Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which type of data is most useful for correlating user activity across multiple apps?

   • ATimestamps
   • BAPK version numbers
   • CApp icons
   • DDevice model numbers
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of the SQLite journal file (e.g., -journal or -wal) in forensic recovery?

   • ATo encrypt the database contents
   • BTo store user preferences and settings
   • CTo store the complete database backup for recovery
   • DTo log transactions and allow recovery of recent changes or deleted data
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An examiner is investigating a corporate-owned Android device used by an employee. The device is not rooted, and the examiner needs to access app data from a messaging app for an internal investigation. The app has disabled Android backups. Which method would be most appropriate to access the app's data?

   • AUse the Android Debug Bridge (adb) backup command, even though the app has disabled backups, since it may still work.
   • BUse a forensic tool that exploits a vulnerability in the device's firmware to gain root access and extract the app's data.
   • CAsk the employee to provide their credentials and log into the app to view the messages.
   • DPerform a logical extraction of the device and hope that the app's data is stored in external storage.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An examiner is reconstructing a user's activities from an Android device. The user has a food delivery app, a payment app, and a maps app. The food delivery app stores order history in its internal database. The payment app stores transaction records in a cloud-synced account. The maps app stores recent searches in shared preferences. Which combination of data sources would provide the most reliable evidence of the user's physical activities?

   • AUse only the payment app's transaction records because they are cloud-synced and cannot be deleted.
   • BUse only the food delivery app's order history because it includes delivery addresses.
   • CUse only the maps app's search history because it shows where the user intended to go.
   • DCorrelate the food delivery app's order timestamps and delivery addresses with the payment app's transaction timestamps and the maps app's search history.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic examiner is investigating a suspect who used a cloud-synced note-taking app on an Android device. The device's local database has been deleted, but the examiner has obtained a legal copy of the cloud data. The cloud data includes a version history of the notes. How should the examiner use this data to reconstruct the suspect's activities?

   • AUse the cloud data to recover the deleted local database by downloading the backup and restoring it to the device.
   • BAssume the cloud data is identical to the local database and use it to determine the exact state of the device at the time of deletion.
   • CAnalyze the version history timestamps and content changes to identify when notes were created, edited, and deleted, then correlate with other device artifacts.
   • DTreat the cloud data as the definitive source and ignore the device's other artifacts, since the local database is deleted.
   Reveal Solution Discussion Select an answer first