GIAC Advanced Smartphone Forensics
Domain 2Objective 3
Apple Device File System Artifacts GASF Practice Questions (Page 1)
Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
10concepts
Questions 1–5
- 1
In HFS+, which structure is the primary catalog file that stores file and folder records?
Select an answer first - 2
An examiner is investigating a suspect's iPhone and needs to find the user's saved Wi-Fi passwords. Which artifact should the examiner examine?
Select an answer first - 3
You are investigating an iPhone that was previously enrolled in a corporate MDM. You need to determine when the device was last managed and by which MDM server. Which files would you examine?
Select an answer first - 4
In the iOS filesystem hierarchy, which directory is the root of the user data partition and contains user-installed apps and their data?
Select an answer first - 5
An examiner is analyzing an iOS device and needs to determine the phone numbers and timestamps of incoming and outgoing calls. Which filesystem location and artifact should the examiner prioritize?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.