A forensic examiner is analyzing a location-sharing app on an Android device. The app requests permission to access the device's location and stores location history in an internal database. Which statement accurately describes the forensic implications of the app's sandboxing and permissions?

The location permission is stored in the database, allowing the examiner to determine the user's location history without accessing the database.

The app's database is protected by the app sandbox, but the location permission allows the app to write location data to the database, which can be extracted with appropriate access.

The app's sandbox prevents the app from writing location data to the database, so no location history is stored.

The location permission grants the examiner direct access to the app's database without needing to bypass the sandbox.

During an investigation, you find that a web browser app stores its browsing history in a SQLite database, but the database has been deleted. However, the app's cache directory contains several files that may contain fragments of the browsing history. Which approach is most appropriate?

Use the app's shared preferences to recover the browsing history, as they store recent URLs.

Only search for the deleted database in unallocated space, as it is the only source of browsing history.

Ignore the cache because it is not a reliable source of browsing history.

Analyze the cache files for URLs and timestamps, and correlate them with any remnants of the deleted database in unallocated space.

A forensic examiner is working on a non-rooted Android device. The target app's database is located in the app's internal storage, which is protected by Android's sandboxing. The examiner needs to acquire the database for analysis. Which method is most appropriate?

Ask the user to open the app and manually export the database to external storage.

Enable USB debugging and use a forensic tool that exploits a vulnerability to bypass the sandbox.

Perform a full device backup using adb backup (if the app allows it) and extract the database from the backup file.

Use the Android Debug Bridge (adb) to pull the database directly from the app's internal storage.

What is the primary purpose of Android SharedPreferences?

To store relational data in tables

To store large binary files such as images and videos

To store small key-value pairs of primitive data types

To store temporary cache files for network responses

GIAC Advanced Smartphone Forensics

Domain 3Objective 2

Android Device Application Analysis GASF Practice Questions (Page 9)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 41–45

41application · medium
A forensic examiner is analyzing a location-sharing app on an Android device. The app requests permission to access the device's location and stores location history in an internal database. Which statement accurately describes the forensic implications of the app's sandboxing and permissions?
Select an answer first
42application · medium
During an investigation, you find that a web browser app stores its browsing history in a SQLite database, but the database has been deleted. However, the app's cache directory contains several files that may contain fragments of the browsing history. Which approach is most appropriate?
Select an answer first
43application · medium
A forensic examiner is working on a non-rooted Android device. The target app's database is located in the app's internal storage, which is protected by Android's sandboxing. The examiner needs to acquire the database for analysis. Which method is most appropriate?
Select an answer first
44foundation · easy
Where are an Android app's cache files typically stored?
Select an answer first
45foundation · easy
What is the primary purpose of Android SharedPreferences?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.