Android Device File System Artifacts GASF Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the /data partition of an Android device, which directory path is the standard location for a specific app's internal storage, including its databases and shared preferences?

   • A/data/user/0/<package_name>/
   • B/data/app/<package_name>/
   • C/sdcard/Android/data/<package_name>/
   • D/data/data/<package_name>/
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You are performing forensic analysis on an Android device with full-disk encryption (FDE) that was powered off at seizure. You have obtained a forensic image of the userdata partition. You need to recover deleted files that may contain evidence. Which approach is most likely to yield recoverable data?

   • ADecrypt the partition using the user's passcode, then perform file carving on the decrypted image.
   • BUse wear leveling information to reconstruct deleted files from the physical flash memory.
   • CPerform file carving directly on the encrypted image because encryption does not affect deleted data.
   • DAnalyze the ext4 journal to recover deleted files without decryption.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of journaling in the ext4 file system?

   • ATo prevent wear leveling
   • BTo ensure file system consistency after a crash or power loss
   • CTo improve read performance
   • DTo encrypt file contents
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An examiner is analyzing a logical acquisition from an Android device. The suspect's messaging app stores messages in an SQLite database at /data/data/com.example.messenger/databases/messages.db. The examiner wants to recover messages that the user deleted from the app's interface. Which approach is most likely to recover the deleted messages?

   • AQuery the messages table and look for rows with a deleted flag set to 1
   • BCarve the database file's unallocated space and the write-ahead log (WAL) for remnants of deleted records
   • CCheck the app's shared preferences file for a backup of deleted messages
   • DOpen the database in a SQLite browser and run a query to select all rows from the messages table
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are investigating an Android device and need to determine if a specific app was used at a particular time. The device's logcat buffers have been rotated, but you have a forensic image of the /data partition. Which artifact is most likely to contain historical app usage logs?

   • AThe event log buffer stored in /dev/log/events.
   • BThe system's main logcat buffer, which is stored in /dev/log/main.
   • CThe app's own log files stored in /data/data/<package>/files/ or /data/data/<package>/cache/.
   • DThe kernel log buffer stored in /proc/kmsg.
   Reveal Solution Discussion Select an answer first