A forensic examiner is analyzing an Android device and finds a cache directory under /data/data/com.example.weather/cache/. The cache contains several image files. What is the most important reason to examine these cache files?

They are required to reconstruct the app's UI layout.

They contain the app's encryption keys.

They may contain residual data from deleted user activity or location-specific images that were not intended to be stored permanently.

They are the primary source for the app's SQLite databases.

You are examining an Android device and find a database in /data/data/com.google.android.gms/databases/ that contains sync timestamps and account information. What is the primary forensic value of this database?

It contains the full content of all emails sent and received.

It can help establish a timeline of when the device synchronized with Google services.

It contains the user's Google account password.

It contains the device's IMEI and phone number.

GIAC Advanced Smartphone Forensics

Domain 2Objective 2

Android Device File System Artifacts GASF Practice Questions (Page 8)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

12concepts

Questions 36–40

36foundation · easy
Which Android partition is specifically designated for storing temporary system files and over-the-air (OTA) update packages?
Select an answer first
37application · medium
A forensic examiner is analyzing an Android device and finds a cache directory under /data/data/com.example.weather/cache/. The cache contains several image files. What is the most important reason to examine these cache files?
Select an answer first
38application · easy
An examiner is analyzing a physical image of an Android device and wants to locate the user's installed applications and their data. Which directory should the examiner focus on?
Select an answer first
39foundation · easy
Which logcat buffer is specifically designed to store high-level system events such as screen on/off, boot completion, and activity lifecycle changes?
Select an answer first
40application · medium
You are examining an Android device and find a database in /data/data/com.google.android.gms/databases/ that contains sync timestamps and account information. What is the primary forensic value of this database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Android Device File System Artifacts GASF Practice Questions (Page 8)

Questions 36–40

Which Android partition is specifically designated for storing temporary system files and over-the-air (OTA) update packages?

A forensic examiner is analyzing an Android device and finds a cache directory under /data/data/com.example.weather/cache/. The cache contains several image files. What is the most important reason to examine these cache files?

An examiner is analyzing a physical image of an Android device and wants to locate the user's installed applications and their data. Which directory should the examiner focus on?

Which logcat buffer is specifically designed to store high-level system events such as screen on/off, boot completion, and activity lifecycle changes?

You are examining an Android device and find a database in /data/data/com.google.android.gms/databases/ that contains sync timestamps and account information. What is the primary forensic value of this database?

Keep studying — Mobile Device File System Analysis