You have seized an Android device that is powered on and locked with a PIN. The device uses file-based encryption (FBE). You need to acquire the device's user data for forensic analysis. Which acquisition method is most likely to yield the most complete and forensically sound data?

Remove the microSD card and image it separately, ignoring the internal storage.

Perform a physical acquisition immediately without unlocking the device.

Use a cold boot attack to extract the encryption keys from RAM.

Perform a logical acquisition using ADB while the device is unlocked, then create a forensic image of the userdata partition.

You are investigating a suspected data exfiltration incident involving an Android device. The user claims they only used the device for personal calls and texts. You need to determine whether any third-party apps were installed or run around the time of the incident. Which combination of artifacts would provide the most reliable evidence of app installation and execution?

The /data/system/users/0/accounts.xml file and the /data/misc/profiles directory.

Package manager logs in /data/log and recent entries in logcat buffers.

The /data/system/packages.xml file and the /data/system/device_policies.xml file.

Browser history and cache files from the default browser.

An examiner has a physical image of an Android device that uses File-Based Encryption (FBE). The device is powered off and the examiner does not have the lock screen credentials. Which data can the examiner expect to access?

Only the device encrypted (DE) files, not the credential encrypted (CE) files

All user data, because FBE only encrypts the /data partition and the image is a raw copy

Only the credential encrypted (CE) files, not the device encrypted (DE) files

No data, because the entire partition is encrypted with a single key

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 4)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 16–20

16foundation · easy
Which Android logging system provides a continuous stream of system and application log messages that can be captured via the logcat command?
Select an answer first
17expert · hard
You have seized an Android device that is powered on and locked with a PIN. The device uses file-based encryption (FBE). You need to acquire the device's user data for forensic analysis. Which acquisition method is most likely to yield the most complete and forensically sound data?
Select an answer first
18foundation · easy
Which of the following is a cloud synchronization artifact that can reveal the user's Google account and sync timestamps?
Select an answer first
19application · medium
You are investigating a suspected data exfiltration incident involving an Android device. The user claims they only used the device for personal calls and texts. You need to determine whether any third-party apps were installed or run around the time of the incident. Which combination of artifacts would provide the most reliable evidence of app installation and execution?
Select an answer first
20expert · hard
An examiner has a physical image of an Android device that uses File-Based Encryption (FBE). The device is powered off and the examiner does not have the lock screen credentials. Which data can the examiner expect to access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Android Device File System Artifacts GASF Practice Questions (Page 4)

Questions 16–20

Which Android logging system provides a continuous stream of system and application log messages that can be captured via the logcat command?

You have seized an Android device that is powered on and locked with a PIN. The device uses file-based encryption (FBE). You need to acquire the device's user data for forensic analysis. Which acquisition method is most likely to yield the most complete and forensically sound data?

Which of the following is a cloud synchronization artifact that can reveal the user's Google account and sync timestamps?

An examiner has a physical image of an Android device that uses File-Based Encryption (FBE). The device is powered off and the examiner does not have the lock screen credentials. Which data can the examiner expect to access?

Keep studying — Mobile Device File System Analysis