What type of sensitive data is typically stored in the iOS Keychain?

Passwords, tokens, and encryption keys

You are investigating a case where a user deleted a video from a social media app. The app stores videos in its Documents directory and uses a SQLite database to track metadata. You have a full file system image. What is the most likely place to find remnants of the deleted video?

In the app's tmp directory, which may contain a temporary copy of the video.

In the app's Library/Preferences plist file, which may contain a reference to the video.

In unallocated space, where the video file's data blocks may remain after deletion.

In the SQLite database, which may contain the video's binary data.

You are analyzing an iTunes backup to recover app data. The backup is encrypted, and you have the password. However, you notice that some app data is missing from the backup. What is the most likely reason?

The backup was created before the app was installed

The app data is stored in the Keychain, which is not backed up

The backup password is incorrect for some files

The app uses the NSURLIsExcludedFromBackupKey attribute to exclude data from backups

What type of data is typically stored in an iOS app's Library/Preferences plist file?

User preferences and settings for the app

Temporary files that are purged regularly

SQLite databases used for user data

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 3)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 11–15

11foundation · easy
What type of sensitive data is typically stored in the iOS Keychain?
Select an answer first
12expert · hard
You are investigating a case where a user deleted a video from a social media app. The app stores videos in its Documents directory and uses a SQLite database to track metadata. You have a full file system image. What is the most likely place to find remnants of the deleted video?
Select an answer first
13expert · hard
You are analyzing an iTunes backup to recover app data. The backup is encrypted, and you have the password. However, you notice that some app data is missing from the backup. What is the most likely reason?
Select an answer first
14foundation · easy
What type of data is typically stored in an iOS app's Library/Preferences plist file?
Select an answer first
15foundation · easy
Which of the following is a common forensic artifact that can be recovered from an iOS app's SQLite database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.