GIAC Advanced Smartphone Forensics
Domain 2Objective 2
Android Device File System Artifacts GASF Practice Questions (Page 7)
Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)
53questions here
11free pages
12concepts
Questions 31–35
- 31
During a forensic examination of an Android device, you locate a SQLite database in /data/data/com.example.chat/databases/ that contains the user's chat history. However, several messages that appear in the app's UI are missing from the database. You suspect the app may have deleted those messages and you want to recover them. Which approach is most likely to recover the deleted chat messages?
Select an answer first - 32
You are examining a photo that was allegedly taken with an Android device. The photo's EXIF data shows a GPS location and a timestamp. However, the file's creation timestamp on the device is several hours later. What is the most likely explanation?
Select an answer first - 33
Which of the following is a key characteristic of Android Auto Backup for apps?
Select an answer first - 34
In an ext4 file system, which structure is used to track free and allocated blocks and can be analyzed to locate deleted file data?
Select an answer first - 35
Which SQLite command is used to list all tables in a database file?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.