Apple Device Application Analysis GASF Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are investigating a case where a user deleted several photos from a third-party photo editing app on an iOS device. You have a full file system image. Which technique is most likely to recover the deleted photos?

   • ALook for the photos in the app's Library/Preferences plist files.
   • BCheck the app's SQLite database for deleted records and recover the original file paths.
   • CCarve for image file signatures in unallocated space and in the app's tmp directory.
   • DRestore the device from an iCloud backup to recover the deleted photos.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are analyzing an encrypted iTunes backup of an iPhone. You have the user's password. Which approach is most efficient to extract and analyze the app data from the backup?

   • ADirectly query the backup's SQLite databases without decryption because they are stored in plaintext
   • BUse the backup's Info.plist to reconstruct the file system and then manually copy app folders
   • CUse a forensic tool that supports encrypted backup decryption and then parse the Manifest.db to locate app files
   • DOnly extract the Keychain data from the backup, as it contains all app data
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are analyzing a plist file from an iOS app that appears to contain a dictionary with multiple keys. One key contains a data blob that is an NSKeyedArchiver archive. Another key contains a string that looks like a URL. What is the most efficient way to extract the archived object's contents?

   • AUse a plist parser that supports NSKeyedArchiver deserialization to automatically decode the data blob.
   • BConvert the plist to XML using plutil and then read the data blob as a base64 string.
   • CManually parse the binary plist structure to extract the archived object's bytes and then decode them with a hex editor.
   • DOpen the plist in a text editor and search for the URL string, ignoring the data blob.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You are examining an iOS app that stores user-generated content. You need to determine which files are most likely to be backed up to iCloud and which are not. The app stores large media files in its Documents directory, preferences in Library/Preferences, and temporary files in tmp. What is the most accurate statement regarding iCloud backup?

   • AFiles in Documents and Library/Preferences are typically backed up, while tmp is excluded.
   • BFiles in Documents are backed up, but Library/Preferences and tmp are not.
   • CFiles in Library/Preferences are backed up, but Documents and tmp are not.
   • DAll files in the app sandbox are backed up to iCloud.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are investigating a messaging app that uses SQLite for storage. The user has deleted a conversation, but you suspect the data may still be recoverable. Which SQLite file should you examine first for remnants of the deleted conversation?

   • AThe main database file (e.g., messages.sqlite)
   • BThe write-ahead log (WAL) file
   • CThe database's index files
   • DThe rollback journal file
   Reveal Solution Discussion Select an answer first