You are examining an iPhone 11 running iOS 14. The device was acquired via a file system image. You need to recover deleted files, but the APFS container has several snapshots. Which approach is most effective?

Mount each snapshot and compare them to identify deleted files.

Ignore snapshots and carve unallocated space directly.

Mount the most recent snapshot and recover deleted files from it.

Use the APFS container's free space to recover deleted files.

Which of the following is a key difference between HFS+ and APFS that is important for forensic analysis?

HFS+ uses 64-bit inode numbers, while APFS uses 32-bit

HFS+ is case-sensitive by default, while APFS is case-insensitive

HFS+ uses a single volume per partition, while APFS uses a container with multiple volumes

HFS+ supports snapshots, while APFS does not

An examiner is working with an iPhone 4s running iOS 6, which uses HFS+. The examiner needs to recover a deleted note. Which HFS+ structure is most likely to contain remnants of the deleted note's file data?

The journal file, which logs metadata changes.

The extents overflow file, which stores extents for fragmented files.

The allocation file, which tracks block allocation.

The catalog file, which contains file records and may retain deleted entries.

You are analyzing a binary plist file that contains a timestamp. The timestamp value is 123456789. You need to determine the correct date. Which reference date should you use?

January 1, 2000 (Y2K reference).

January 1, 2001 (Apple Cocoa/Core Data reference date).

January 1, 1980 (FAT timestamp).

Where are SMS and iMessage conversations stored on an iOS device?

/var/mobile/Library/AddressBook/AddressBook.sqlitedb

/var/mobile/Library/CallHistory/call_history.db

/var/mobile/Library/Safari/History.db

GIAC Advanced Smartphone Forensics

Domain 2Objective 3

Apple Device File System Artifacts GASF Practice Questions (Page 2)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 6–10

6expert · hard
You are examining an iPhone 11 running iOS 14. The device was acquired via a file system image. You need to recover deleted files, but the APFS container has several snapshots. Which approach is most effective?
Select an answer first
7foundation · easy
Which of the following is a key difference between HFS+ and APFS that is important for forensic analysis?
Select an answer first
8application · medium
An examiner is working with an iPhone 4s running iOS 6, which uses HFS+. The examiner needs to recover a deleted note. Which HFS+ structure is most likely to contain remnants of the deleted note's file data?
Select an answer first
9expert · hard
You are analyzing a binary plist file that contains a timestamp. The timestamp value is 123456789. You need to determine the correct date. Which reference date should you use?
Select an answer first
10foundation · easy
Where are SMS and iMessage conversations stored on an iOS device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.