You are trying to recover deleted files from an Android device's internal storage. The device uses ext4 with journaling and flash storage with wear leveling. Which factor most significantly complicates the recovery of deleted files?

The TRIM command immediately erases deleted data, making recovery impossible.

Wear leveling can cause the physical blocks containing deleted data to be remapped and overwritten, reducing the chance of recovery.

File-based encryption prevents any deleted data from being recovered.

The ext4 journal only records metadata, so deleted file content is never recoverable.

How does wear leveling in flash storage affect forensic data recovery?

It has no effect on forensic recovery.

It can move data blocks, making it harder to recover deleted files from their original locations.

It ensures deleted files are immediately overwritten.

It prevents data from being recovered from unallocated space.

An examiner finds a video file in the /data/media/0/Movies directory. The examiner needs to determine the original creation date of the video. Which metadata should the examiner examine?

The media store database entry for the video

The file system creation time (crtime)

The video's metadata (e.g., MP4 metadata)

The file name (e.g., VID_20230101_123456.mp4)

A forensic examiner has an ADB backup file (backup.ab) from an Android device. The backup was created with the backup password option enabled. The examiner needs to extract the app data for a specific application. What is the first step the examiner should take?

Use the Android backup extractor tool with the password to decrypt and unpack the archive

Rename the file to backup.tar and extract it with a standard tar utility

Open the file in a hex editor and search for the app's package name

Convert the backup to a sparse image and mount it with a loop device

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 10)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 46–50

46expert · hard
You are trying to recover deleted files from an Android device's internal storage. The device uses ext4 with journaling and flash storage with wear leveling. Which factor most significantly complicates the recovery of deleted files?
Select an answer first
47foundation · easy
How does wear leveling in flash storage affect forensic data recovery?
Select an answer first
48foundation · easy
Which metadata standard is commonly embedded in JPEG images and can contain information such as camera model, GPS coordinates, and timestamp?
Select an answer first
49application · medium
An examiner finds a video file in the /data/media/0/Movies directory. The examiner needs to determine the original creation date of the video. Which metadata should the examiner examine?
Select an answer first
50application · medium
A forensic examiner has an ADB backup file (backup.ab) from an Android device. The backup was created with the backup password option enabled. The examiner needs to extract the app data for a specific application. What is the first step the examiner should take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.