You are investigating a case involving a suspect's iPhone. The device is running iOS 15 and is passcode-protected. You have obtained a court order and are attempting to extract data. The device is not jailbroken, and you have limited time. You need to recover deleted WhatsApp messages. Which approach is most effective?

Perform a logical backup and analyze the WhatsApp SQLite database and WAL files

Request the suspect's iCloud credentials and download the iCloud backup

Attempt to brute-force the passcode to enable full disk access

Use a commercial forensic tool to perform a full file system extraction and then carve for deleted SQLite records

You are analyzing a third-party email app on an iOS device. You need to recover the user's email account credentials. Where are these credentials most likely stored?

In the app's SQLite database in an unencrypted table.

In the iOS Keychain, protected by the device's passcode.

In the app's Library/Preferences plist file.

In the app's Documents folder as a plaintext configuration file.

You are investigating a case involving a social media app. The user has deleted several direct messages, but you suspect remnants may exist. Which location is most likely to contain remnants of the deleted messages?

The app's tmp folder where temporary files are stored

The app's SQLite database WAL and journal files

The app's Documents folder where messages are archived

The app's Library/Preferences plist files

You are investigating a case involving a messaging app. The user deleted a conversation, and you have a full file system image. The app uses SQLite with WAL mode. You find the main database and a WAL file. What is the most comprehensive approach to recover the deleted conversation?

Use a SQLite recovery tool that automatically merges the WAL and main database, but ignore freelist pages.

Only analyze the WAL file, because the main database is overwritten when data is deleted.

Only analyze the main database, because the WAL file is automatically checkpointed and contains no deleted data.

Parse the WAL file for committed transactions and also carve the database's freelist pages for deleted row remnants.

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 6)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 26–30

26expert · hard
You are investigating a case involving a suspect's iPhone. The device is running iOS 15 and is passcode-protected. You have obtained a court order and are attempting to extract data. The device is not jailbroken, and you have limited time. You need to recover deleted WhatsApp messages. Which approach is most effective?
Select an answer first
27application · medium
You are analyzing a third-party email app on an iOS device. You need to recover the user's email account credentials. Where are these credentials most likely stored?
Select an answer first
28application · medium
You are investigating a case involving a social media app. The user has deleted several direct messages, but you suspect remnants may exist. Which location is most likely to contain remnants of the deleted messages?
Select an answer first
29expert · hard
You are investigating a case involving a messaging app. The user deleted a conversation, and you have a full file system image. The app uses SQLite with WAL mode. You find the main database and a WAL file. What is the most comprehensive approach to recover the deleted conversation?
Select an answer first
30application · medium
You are analyzing an iTunes backup to recover app data. You need to understand the structure of the backup to locate files for a specific app. Which file in the backup provides the mapping between file paths and the backup's file structure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Apple Device Application Analysis GASF Practice Questions (Page 6)

Questions 26–30

You are analyzing a third-party email app on an iOS device. You need to recover the user's email account credentials. Where are these credentials most likely stored?

You are investigating a case involving a social media app. The user has deleted several direct messages, but you suspect remnants may exist. Which location is most likely to contain remnants of the deleted messages?

You are investigating a case involving a messaging app. The user deleted a conversation, and you have a full file system image. The app uses SQLite with WAL mode. You find the main database and a WAL file. What is the most comprehensive approach to recover the deleted conversation?

You are analyzing an iTunes backup to recover app data. You need to understand the structure of the backup to locate files for a specific app. Which file in the backup provides the mapping between file paths and the backup's file structure?

Keep studying — Mobile Device Application Analysis