During a forensic examination, an analyst finds a JPEG image in the /data/media/0/DCIM/Camera directory. The analyst needs to determine the exact date and time the photo was taken, as well as the device model. Which metadata should the analyst examine?

The file system timestamps (atime, mtime, ctime)

The EXIF metadata embedded in the JPEG file

The directory listing from the media store database

The file name (e.g., IMG_20230101_123456.jpg)

During an investigation, you recover a JPEG image from the /sdcard/DCIM/Camera folder of an Android device. The image's EXIF data shows a GPS coordinate and a timestamp. However, the file system timestamp shows the file was created two days after the EXIF timestamp. What is the most likely explanation for this discrepancy?

The file system timestamp is unreliable due to flash wear leveling.

The image was taken with a different device and later transferred to this Android device.

The device's clock was set incorrectly when the photo was taken.

The EXIF data was modified by the Android media scanner.

An examiner is attempting to recover deleted files from an Android device that uses ext4 with journaling. The examiner has a physical image of the userdata partition. Which technique is most likely to recover deleted files?

Mounting the image and using the 'recover' command

Carving the unallocated space of the partition for file signatures

Using the file system's undelete tool

Analyzing the ext4 journal to reconstruct deleted file metadata

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 2)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 6–10

6application · medium
An examiner is investigating a device and wants to determine if the device was rebooted during a specific time frame. Which log file should the examiner analyze?
Select an answer first
7application · medium
During a forensic examination, an analyst finds a JPEG image in the /data/media/0/DCIM/Camera directory. The analyst needs to determine the exact date and time the photo was taken, as well as the device model. Which metadata should the analyst examine?
Select an answer first
8foundation · easy
Which of the following is a key artifact commonly found in the /data partition that stores app-specific settings as key-value pairs?
Select an answer first
9application · medium
During an investigation, you recover a JPEG image from the /sdcard/DCIM/Camera folder of an Android device. The image's EXIF data shows a GPS coordinate and a timestamp. However, the file system timestamp shows the file was created two days after the EXIF timestamp. What is the most likely explanation for this discrepancy?
Select an answer first
10expert · hard
An examiner is attempting to recover deleted files from an Android device that uses ext4 with journaling. The examiner has a physical image of the userdata partition. Which technique is most likely to recover deleted files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Android Device File System Artifacts GASF Practice Questions (Page 2)

Questions 6–10

An examiner is investigating a device and wants to determine if the device was rebooted during a specific time frame. Which log file should the examiner analyze?

During a forensic examination, an analyst finds a JPEG image in the /data/media/0/DCIM/Camera directory. The analyst needs to determine the exact date and time the photo was taken, as well as the device model. Which metadata should the analyst examine?

Which of the following is a key artifact commonly found in the /data partition that stores app-specific settings as key-value pairs?

An examiner is attempting to recover deleted files from an Android device that uses ext4 with journaling. The examiner has a physical image of the userdata partition. Which technique is most likely to recover deleted files?

Keep studying — Mobile Device File System Analysis