You are analyzing a third-party messaging app that claims to use end-to-end encryption. You need to recover the user's contacts and message metadata. The app stores data in a SQLite database and uses the Keychain for encryption keys. What is the most effective strategy?

Focus only on the Keychain, because all app data is encrypted and stored there.

Analyze only the SQLite database, because the Keychain is not accessible without the passcode.

Analyze the SQLite database for contacts and metadata, and attempt to extract encryption keys from the Keychain to decrypt message content if needed.

Ignore the database and Keychain, and instead analyze network traffic logs.

You are analyzing a third-party messaging app on an iOS device. You need to recover deleted messages and associated timestamps. Which combination of files should you examine?

The Keychain and the app's preferences

The app's SQLite database and its WAL file

The app's Documents folder and tmp folder

The app's plist and cache files

In a forensic examination of an iOS device, you need to recover the user's saved passwords for a third-party banking app. The device is jailbroken and you have full file system access. Where should you focus your analysis to find these credentials?

Extract the Keychain database and use the device's escrow keybag to decrypt the entries

Parse the app's SQLite database in Library/Preferences for stored credentials

Look in the app's Documents folder for a plaintext password file

Analyze the app's cache files for login tokens

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 5)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 21–25

21expert · hard
You are analyzing a third-party messaging app that claims to use end-to-end encryption. You need to recover the user's contacts and message metadata. The app stores data in a SQLite database and uses the Keychain for encryption keys. What is the most effective strategy?
Select an answer first
22foundation · easy
What command-line tool is commonly used to examine the structure and contents of an iOS SQLite database?
Select an answer first
23foundation · easy
In the iOS app sandbox, which directory is intended for user-generated content that should be backed up and is visible to the user through the Files app?
Select an answer first
24application · medium
You are analyzing a third-party messaging app on an iOS device. You need to recover deleted messages and associated timestamps. Which combination of files should you examine?
Select an answer first
25application · medium
In a forensic examination of an iOS device, you need to recover the user's saved passwords for a third-party banking app. The device is jailbroken and you have full file system access. Where should you focus your analysis to find these credentials?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Apple Device Application Analysis GASF Practice Questions (Page 5)

Questions 21–25

You are analyzing a third-party messaging app that claims to use end-to-end encryption. You need to recover the user's contacts and message metadata. The app stores data in a SQLite database and uses the Keychain for encryption keys. What is the most effective strategy?

What command-line tool is commonly used to examine the structure and contents of an iOS SQLite database?

In the iOS app sandbox, which directory is intended for user-generated content that should be backed up and is visible to the user through the Files app?

You are analyzing a third-party messaging app on an iOS device. You need to recover deleted messages and associated timestamps. Which combination of files should you examine?

In a forensic examination of an iOS device, you need to recover the user's saved passwords for a third-party banking app. The device is jailbroken and you have full file system access. Where should you focus your analysis to find these credentials?

Keep studying — Mobile Device Application Analysis