GIAC Advanced Smartphone Forensics
Domain 2Objective 3
Apple Device File System Artifacts GASF Practice Questions (Page 6)
Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
10concepts
Questions 26–30
- 26
You have a full file system image of an iPhone. You need to access files that were created while the device was locked. Which data protection class would these files most likely belong to?
Select an answer first - 27
You are investigating an iPhone that was enrolled in an MDM. You need to determine if the device was ever remotely wiped by the MDM. Which log or artifact would you examine?
Select an answer first - 28
Which APFS feature can be used to recover deleted files by accessing a previous version of the file system?
Select an answer first - 29
An organization is investigating a former employee's iPhone to determine if the device was enrolled in a Mobile Device Management (MDM) profile. Which artifact should the examiner examine to confirm MDM enrollment and identify the MDM server?
Select an answer first - 30
Which iOS partition is mounted read-only and contains the core operating system files?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.