An examiner is performing a forensic acquisition of an Android device with full-disk encryption (FDE) enabled. The device is powered on and unlocked. Which acquisition method is most likely to preserve deleted file remnants?

File system acquisition of the /data partition

Physical acquisition of the decrypted userdata partition

Logical acquisition via ADB backup

Logical acquisition via the content provider

A user has an Android device that was backed up using ADB backup. You need to extract the app data from the backup file for forensic analysis. The backup file is encrypted with a password. What is the correct procedure to access the app data?

Rename the file to .tar and extract it directly, ignoring the encryption.

Use a hex editor to locate the app data within the backup file without decryption.

Use the password to decrypt the backup file, then extract the tar archive to access the app data.

Mount the backup file as a loop device to access the app data.

An examiner is analyzing an Android device and finds a database at /data/data/com.google.android.apps.photos/databases/picasa.db. The examiner wants to determine which photos were uploaded to Google Photos and when. Which approach is most effective?

Examine the device's media store database for upload timestamps

Analyze the device's logcat for upload events

Query the picasa.db database for upload timestamps and photo IDs

Check the Google Photos cache directory for uploaded photo thumbnails

An examiner is attempting to recover deleted files from an Android device that uses ext4 file system with journaling and flash storage with wear leveling. The device has been powered off for several days. Which factor most significantly reduces the likelihood of recovering deleted files?

The file system may have been remounted in read-only mode, preventing further writes

Wear leveling may have moved the physical blocks containing the deleted data

The ext4 journal may have overwritten the deleted file's data blocks

The device's encryption key may have been rotated, making the data unreadable

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 5)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 21–25

21application · medium
An examiner is performing a forensic acquisition of an Android device with full-disk encryption (FDE) enabled. The device is powered on and unlocked. Which acquisition method is most likely to preserve deleted file remnants?
Select an answer first
22application · medium
A user has an Android device that was backed up using ADB backup. You need to extract the app data from the backup file for forensic analysis. The backup file is encrypted with a password. What is the correct procedure to access the app data?
Select an answer first
23application · easy
You are analyzing a forensic image of an Android device and need to locate the user's installed applications and their associated data. Which directory path is the primary location for third-party app data?
Select an answer first
24expert · hard
An examiner is analyzing an Android device and finds a database at /data/data/com.google.android.apps.photos/databases/picasa.db. The examiner wants to determine which photos were uploaded to Google Photos and when. Which approach is most effective?
Select an answer first
25expert · hard
An examiner is attempting to recover deleted files from an Android device that uses ext4 file system with journaling and flash storage with wear leveling. The device has been powered off for several days. Which factor most significantly reduces the likelihood of recovering deleted files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.