GIAC Advanced Smartphone Forensics
Domain 2Objective 2
Android Device File System Artifacts GASF Practice Questions (Page 6)
Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)
53questions here
11free pages
12concepts
Questions 26–30
- 26
Which technique is commonly used to recover deleted files from an Android device's ext4 file system?
Select an answer first - 27
What is the file format of an ADB backup file created with the 'adb backup' command?
Select an answer first - 28
An examiner is investigating a device and finds a cache directory at /data/data/com.example.browser/cache. The examiner wants to recover web pages the user recently visited. Which file type is most likely to contain remnants of visited web pages?
Select an answer first - 29
Which file system attribute provides the most reliable timestamp for establishing when a media file was created on an Android device?
Select an answer first - 30
Which directory on an Android device is the standard location for app-specific cache files that may contain residual data from user activity?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.