What is the role of journal files in recovering deleted data from iOS devices?

They contain metadata about file system changes that can help locate deleted file remnants.

They store the actual content of all deleted files.

They are used to encrypt the file system.

They are only present on jailbroken devices.

You are analyzing a third-party email app on an iOS device. The app stores account configuration in a plist file, but the password is not in the plist. You need to recover the password. What is the most likely location for the password?

In a separate SQLite database in the app's Documents folder

In the Keychain, protected by the device passcode

In the app's cache files, as plaintext

In the same plist file, but encrypted with a hardcoded key

Why is extracting data from the iOS Keychain challenging in a forensic examination?

Keychain items are encrypted and protected by the device passcode or biometric authentication.

Keychain items are deleted immediately after use.

Keychain items are stored in a proprietary format that no tool can parse.

Keychain items are stored only in the cloud, not on the device.

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 4)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 16–20

16foundation · easy
What is the role of journal files in recovering deleted data from iOS devices?
Select an answer first
17expert · hard
You are analyzing a third-party email app on an iOS device. The app stores account configuration in a plist file, but the password is not in the plist. You need to recover the password. What is the most likely location for the password?
Select an answer first
18foundation · easy
Which iOS app directory is most likely to contain cached data that can reveal user activity but is not backed up?
Select an answer first
19foundation · easy
Which iOS app sandbox directory is used for temporary files that are not backed up and may be purged by the system when space is needed?
Select an answer first
20foundation · easy
Why is extracting data from the iOS Keychain challenging in a forensic examination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Apple Device Application Analysis GASF Practice Questions (Page 4)

Questions 16–20

What is the role of journal files in recovering deleted data from iOS devices?

You are analyzing a third-party email app on an iOS device. The app stores account configuration in a plist file, but the password is not in the plist. You need to recover the password. What is the most likely location for the password?

Which iOS app directory is most likely to contain cached data that can reveal user activity but is not backed up?

Which iOS app sandbox directory is used for temporary files that are not backed up and may be purged by the system when space is needed?

Why is extracting data from the iOS Keychain challenging in a forensic examination?

Keep studying — Mobile Device Application Analysis