An examiner is working with an older iPhone running iOS 9, which uses HFS+. The device has been seized and the examiner needs to recover deleted files. The device was not jailbroken. Which technique is most appropriate for recovering deleted files from this HFS+ volume?

Mount the APFS container and use snapshot recovery techniques.

Use a forensic tool that supports HFS+ deleted file recovery by parsing the catalog file and extents overflow file.

Rely on the device's built-in 'Recently Deleted' album to recover files.

Perform a physical acquisition and use JTAG to access the raw NAND, then carve for deleted files.

You are analyzing an iOS 15 device image. You need to locate the user's downloaded applications and their data. Which directory path would you examine?

/private/var/mobile/Library/Preferences/

/private/var/mobile/Containers/Bundle/Application/

You are analyzing a plist file that contains a timestamp value of 700000000. You need to convert this to a human-readable date. Which reference date should you use?

January 1, 2000 (Y2K reference).

January 1, 1980 (FAT timestamp).

January 1, 2001 (Apple Cocoa/Core Data reference date).

A forensic examiner has a logical acquisition of an iOS device that is passcode-locked. The acquisition includes the filesystem, but many app data files appear encrypted. The examiner needs to access the contents of a specific app's SQLite database. Which approach is most viable?

Check if the app's files are protected under NSFileProtectionCompleteUntilFirstUserAuthentication; if so, they may be accessible if the device was unlocked after boot.

Attempt to brute-force the passcode offline using the encrypted filesystem image.

Extract the files from an APFS snapshot, which bypasses data protection encryption.

Use the device's hardware encryption key to decrypt the files, which is available in the logical acquisition.

GIAC Advanced Smartphone Forensics

Domain 2Objective 3

Apple Device File System Artifacts GASF Practice Questions (Page 7)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

10concepts

Questions 31–35

31expert · hard
An examiner is working with an older iPhone running iOS 9, which uses HFS+. The device has been seized and the examiner needs to recover deleted files. The device was not jailbroken. Which technique is most appropriate for recovering deleted files from this HFS+ volume?
Select an answer first
32application · medium
You are analyzing an iOS 15 device image. You need to locate the user's downloaded applications and their data. Which directory path would you examine?
Select an answer first
33application · medium
You are analyzing a plist file that contains a timestamp value of 700000000. You need to convert this to a human-readable date. Which reference date should you use?
Select an answer first
34expert · hard
A forensic examiner has a logical acquisition of an iOS device that is passcode-locked. The acquisition includes the filesystem, but many app data files appear encrypted. The examiner needs to access the contents of a specific app's SQLite database. Which approach is most viable?
Select an answer first
35foundation · easy
Which tool or command is commonly used to convert a binary plist to a human-readable XML format on macOS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.