What is the primary forensic significance of an encrypted iOS backup compared to an unencrypted backup?

Encrypted backups are only created when the device is jailbroken.

Encrypted backups do not contain any user data, only system files.

Encrypted backups are faster to analyze because the data is compressed.

Encrypted backups contain more data, including keychain items and some app data that are otherwise excluded.

You are analyzing a third-party messaging app on an iOS device. The app uses end-to-end encryption and stores messages in a SQLite database. You need to recover the encryption keys to decrypt the messages. Where are the keys most likely stored?

In the app's plist file, encrypted with a hardcoded key

In the app's cache files, as plaintext

In the app's SQLite database, in plaintext

In the Keychain, protected by the device passcode

Which of the following is a common forensic artifact found in third-party messaging apps on iOS?

Chat transcripts stored in SQLite databases

Which technique is used to recover deleted data from iOS devices by analyzing the raw file system?

Carving unallocated space for file signatures

During a forensic examination, you need to recover deleted photos from an iOS device. The device is not jailbroken and you have a full file system image. Which technique is most likely to recover the deleted photos?

Parse the photo library's plist for file paths

Check the tmp folder for temporary photo files

Analyze the photo library's SQLite database for deleted records

Carve for JPEG and PNG file signatures in unallocated space

GIAC Advanced Smartphone Forensics

Domain 3Objective 3

Apple Device Application Analysis GASF Practice Questions (Page 8)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 36–40

36foundation · easy
What is the primary forensic significance of an encrypted iOS backup compared to an unencrypted backup?
Select an answer first
37expert · hard
You are analyzing a third-party messaging app on an iOS device. The app uses end-to-end encryption and stores messages in a SQLite database. You need to recover the encryption keys to decrypt the messages. Where are the keys most likely stored?
Select an answer first
38foundation · easy
Which of the following is a common forensic artifact found in third-party messaging apps on iOS?
Select an answer first
39foundation · easy
Which technique is used to recover deleted data from iOS devices by analyzing the raw file system?
Select an answer first
40application · medium
During a forensic examination, you need to recover deleted photos from an iOS device. The device is not jailbroken and you have a full file system image. Which technique is most likely to recover the deleted photos?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.