An examiner needs to locate the user's downloaded apps and their data on an iOS device. Which directory structure should the examiner focus on?

/private/var/stash/Applications/ for app bundles and /private/var/mobile/Documents/ for app data.

/private/var/mobile/Applications/ for both app bundles and data.

/private/var/containers/Bundle/Application/ for app bundles and /private/var/mobile/Containers/Data/Application/ for app data.

/private/var/mobile/Library/ for app bundles and /private/var/mobile/Containers/Data/ for app data.

An examiner is analyzing an APFS image and needs to determine the exact time a file was deleted. The file was deleted, and the device has been used since. Which APFS structure is most likely to contain the deletion timestamp?

The filesystem journal (fsroot) that logs metadata changes.

The volume's free-space bitmap, which marks the blocks as free.

The file's inode in the APFS container's object map.

The APFS snapshot metadata, which records the time the snapshot was taken.

Which iOS Data Protection class allows files to be accessed only when the device is unlocked?

NSFileProtectionCompleteUnlessOpen

NSFileProtectionCompleteUntilFirstUserAuthentication

What is the primary difference between binary and XML plist files?

Binary plists are encoded in a compact binary format, while XML plists are human-readable text

XML plists are only used on macOS, while binary plists are only used on iOS

Binary plists are encrypted, while XML plists are not

Binary plists cannot store arrays, while XML plists can

GIAC Advanced Smartphone Forensics

Domain 2Objective 3

Apple Device File System Artifacts GASF Practice Questions (Page 4)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 16–20

16application · medium
An examiner needs to locate the user's downloaded apps and their data on an iOS device. Which directory structure should the examiner focus on?
Select an answer first
17expert · hard
An examiner is analyzing an APFS image and needs to determine the exact time a file was deleted. The file was deleted, and the device has been used since. Which APFS structure is most likely to contain the deletion timestamp?
Select an answer first
18foundation · easy
Which iOS Data Protection class allows files to be accessed only when the device is unlocked?
Select an answer first
19foundation · easy
What is the primary difference between binary and XML plist files?
Select an answer first
20foundation · easy
Which timestamp format is used by many iOS applications and represents the number of seconds since January 1, 2001?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.