An examiner is analyzing an Android device and wants to identify which Google account was used to back up app data. Which file should the examiner examine?

/data/system/device_policies.xml

/data/data/com.google.android.gms/databases/phenotype.db

/data/system/users/0/accounts.db

Which of the following best describes the difference between internal and external storage for an Android app?

Internal storage is private to the app, while external storage is shared and may be accessible by other apps or the user.

Internal storage is encrypted, while external storage is not.

Internal storage is for databases, while external storage is for files.

Internal storage is on the device, while external storage is on a removable SD card.

Which of the following is a common artifact left by Google Drive synchronization on an Android device?

SQLite databases in the app's data directory

EXIF metadata in cloud-stored images

An examiner is investigating a device and finds a temporary file in the /data/data/com.example.app/cache directory. The file has a .tmp extension. What is the most likely purpose of this file?

It is a configuration file for the app

It is a temporary file created by the app during normal operation

It is a backup of the app's database

An examiner is investigating a device and wants to determine whether a user plugged the device into a computer via USB around a specific time. Which log file should the examiner prioritize?

The system log (system.log) which records system service messages

The app log (app.log) which records application-level messages

The event log (event.log) which records system events like boot and user activity

The kernel log (dmesg) which records USB events

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 3)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 11–15

11application · medium
An examiner is analyzing an Android device and wants to identify which Google account was used to back up app data. Which file should the examiner examine?
Select an answer first
12foundation · easy
Which of the following best describes the difference between internal and external storage for an Android app?
Select an answer first
13foundation · easy
Which of the following is a common artifact left by Google Drive synchronization on an Android device?
Select an answer first
14application · easy
An examiner is investigating a device and finds a temporary file in the /data/data/com.example.app/cache directory. The file has a .tmp extension. What is the most likely purpose of this file?
Select an answer first
15application · medium
An examiner is investigating a device and wants to determine whether a user plugged the device into a computer via USB around a specific time. Which log file should the examiner prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.