You have two backups of the same iPhone: one is an encrypted backup from three months ago, and the other is an unencrypted backup from last week. You need to recover the user's saved Wi-Fi passwords. Which backup should you use and why?

Use the encrypted backup, because Wi-Fi passwords are stored in the Keychain and are only included in encrypted backups.

Use neither backup, because Wi-Fi passwords are not backed up at all.

Use both backups, because Wi-Fi passwords are stored in both but in different formats.

Use the unencrypted backup, because it is more recent and contains the latest Wi-Fi passwords.

You are analyzing a messaging app's SQLite database from an iOS device. You need to recover deleted messages. The database has a WAL (Write-Ahead Logging) file. What is the most effective approach to recover the deleted messages?

Use a hex editor to search the entire database file for the message text, ignoring the WAL file.

Examine the WAL file for deleted records and also check the main database's freelist pages for remnants.

Delete the WAL file and reopen the database to force a checkpoint, which will restore deleted data.

Simply open the main database and query the message table; deleted records are often still present.

What type of metadata might be recovered from a social media app's data on an iOS device?

The device's hardware serial number

Timestamps of posts and messages

You are examining a third-party messaging app's SQLite database. The database is in WAL mode, and you notice that the WAL file is large. You need to recover deleted messages. What is the best strategy?

Run a checkpoint to merge the WAL into the main database

Copy the main database file and ignore the WAL file

Delete the WAL file to force the database to use the main file only

Parse the WAL file directly for deleted records before checkpointing

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 2)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 6–10

6foundation · easy
Which tool is commonly used to parse and view the contents of iOS property list (plist) files?
Select an answer first
7expert · hard
You have two backups of the same iPhone: one is an encrypted backup from three months ago, and the other is an unencrypted backup from last week. You need to recover the user's saved Wi-Fi passwords. Which backup should you use and why?
Select an answer first
8application · medium
You are analyzing a messaging app's SQLite database from an iOS device. You need to recover deleted messages. The database has a WAL (Write-Ahead Logging) file. What is the most effective approach to recover the deleted messages?
Select an answer first
9foundation · easy
What type of metadata might be recovered from a social media app's data on an iOS device?
Select an answer first
10expert · hard
You are examining a third-party messaging app's SQLite database. The database is in WAL mode, and you notice that the WAL file is large. You need to recover deleted messages. What is the best strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.