Apple Device Application Analysis GASF Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are analyzing an encrypted iTunes backup of an iPhone. After successfully decrypting the backup, you need to locate the SQLite database for a messaging app. What is the most reliable method to find the correct database file within the backup?

   • ACheck the Info.plist of the backup to find the app's container path, then navigate to that path in the backup.
   • BLook in the root of the backup for a folder named after the app's display name and open the database file directly.
   • CUse the backup's Manifest.db to map the app's bundle ID to its relative file paths, then extract the SQLite files from the corresponding subdirectories.
   • DSearch the entire backup directory for files with a .sqlite extension and test each one in a SQLite browser.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   You are analyzing a WhatsApp backup from an iOS device. You need to recover chat history and associated media metadata. Which files should you prioritize in your analysis?

   • AThe Library/Caches folder for message logs
   • BThe ChatStorage.sqlite database and its associated WAL files
   • CThe Documents/Inbox folder for received media
   • DThe com.whatsapp.plist preferences file
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What type of file is commonly used by iOS apps for logging events and errors, and can be analyzed to reconstruct user actions?

   • ALog files (e.g., .log or .txt)
   • BPlist files
   • CKeychain items
   • DSQLite databases
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   You are analyzing an encrypted iTunes backup of an iPhone. The backup password is known, but you cannot extract Keychain items. The device itself is not available. What is the most likely reason for this limitation?

   • AThe backup was created with an older iOS version that does not support Keychain extraction
   • BThe Keychain items are encrypted with a key derived from the device's passcode, which is not available
   • CThe backup password is incorrect for Keychain decryption
   • DKeychain items are not included in encrypted backups
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You are investigating a case involving a social media app. The user has deleted several photos from the app's cache. You have a full file system image. Which technique is most likely to recover the deleted photos?

   • AParse the app's plist for photo file paths
   • BCheck the app's tmp folder for deleted files
   • CCarve for image file signatures in unallocated space
   • DAnalyze the app's SQLite database for photo metadata
   Reveal Solution Discussion Select an answer first