An examiner has a forensic image of an iPhone that is passcode-protected. The examiner needs to access the contents of the user's Messages app database. The device was last unlocked 30 minutes before it was seized, and it has not been rebooted. Which approach is most likely to yield access to the Messages database?

Use a forensic tool that can exploit the device's unlocked state to extract the keybag from memory.

Perform a brute-force attack on the device's passcode using the image.

Extract the database from an APFS snapshot, which bypasses encryption.

Use a logical acquisition tool to copy the database directly from the device.

You are examining an iOS device and need to determine when a specific contact was last modified. The contact is stored in the Contacts database. Which database and table would you examine to find this information?

SMS.db, message table, date column.

SafariHistory.db, history_items table, visit_time column.

CallHistory.storedata, ZCALLRECORD table, ZDATE column.

AddressBook.sqlitedb, ZABCDCONTACT table, ZMODIFICATIONDATE column.

You need to determine the exact time a specific call was made on an iOS device. Which database and table would you query?

CallHistory.storedata, ZCALLRECORD table, ZDATE column.

SMS.db, message table, date column.

AddressBook.sqlitedb, ZABCDCONTACT table, ZMODIFICATIONDATE column.

SafariHistory.db, history_items table, visit_time column.

GIAC Advanced Smartphone Forensics

Domain 2Objective 3

Apple Device File System Artifacts GASF Practice Questions (Page 5)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 21–25

21foundation · easy
Which SQLite command is used to view the schema of a database, including all tables and their columns?
Select an answer first
22expert · hard
An examiner has a forensic image of an iPhone that is passcode-protected. The examiner needs to access the contents of the user's Messages app database. The device was last unlocked 30 minutes before it was seized, and it has not been rebooted. Which approach is most likely to yield access to the Messages database?
Select an answer first
23application · medium
You are examining an iOS device and need to determine when a specific contact was last modified. The contact is stored in the Contacts database. Which database and table would you examine to find this information?
Select an answer first
24application · medium
You need to determine the exact time a specific call was made on an iOS device. Which database and table would you query?
Select an answer first
25foundation · easy
In APFS, which structure is the top-level container that holds one or more volumes and manages space allocation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Apple Device File System Artifacts GASF Practice Questions (Page 5)

Questions 21–25

Which SQLite command is used to view the schema of a database, including all tables and their columns?

You are examining an iOS device and need to determine when a specific contact was last modified. The contact is stored in the Contacts database. Which database and table would you examine to find this information?

You need to determine the exact time a specific call was made on an iOS device. Which database and table would you query?

In APFS, which structure is the top-level container that holds one or more volumes and manages space allocation?

Keep studying — Mobile Device File System Analysis