GIAC Advanced Smartphone Forensics
Domain 2Objective 3
Apple Device File System Artifacts GASF Practice Questions (Page 3)
Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
10concepts
Questions 11–15
- 11
In iOS SQLite databases, which table is commonly used to track deleted records and is often examined to recover deleted data?
Select an answer first - 12
Which timestamp format is commonly used in Apple's HFS+ file system and represents the number of seconds since January 1, 1904?
Select an answer first - 13
Which APFS feature is most relevant to forensic recovery because it preserves the state of the file system at a point in time?
Select an answer first - 14
What is the primary impact of Apple's Data Protection on forensic acquisition of an iOS device?
Select an answer first - 15
In HFS+, what is the primary technique for recovering deleted files when no snapshot is available?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.