Mobile Device Application Analysis GASF Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   You are investigating a suspect's Android phone. The suspect used a secure messaging app that encrypts messages and deletes them after a short time. You have a physical image of the device, but the app's database is encrypted and the key is not stored on the device. Which technique is most likely to recover the plaintext messages?

   • AUse a cloud backup of the app to retrieve the messages.
   • BBrute-force the encryption key using the device's GPU.
   • CCheck the device's RAM for the decryption key or plaintext messages, if a live acquisition was performed.
   • DLook for the key in the app's shared preferences file.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are writing a forensic report about a suspect's use of a ride-sharing app. You have found trip history, payment information, and location data. What is the best way to present this information in the report?

   • AProvide raw database dumps and let the reader interpret the data.
   • BSummarize the findings in a narrative without technical details.
   • CInclude only the most incriminating trip, as it is the most relevant to the case.
   • DInclude a table of trips with timestamps, locations, and payment amounts, and explain how the data was extracted.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key requirement for a forensic report documenting application data findings?

   • AIt must contain only the final conclusions without any supporting data.
   • BIt must be written in a highly technical language only experts can understand.
   • CIt must be encrypted and not shared with anyone.
   • DIt must include the tools used, methods applied, and the findings in a clear and reproducible manner.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You have extracted a database from a suspect's phone and need to present it in court. To ensure the data is admissible, which step is most critical?

   • AUse a commercial forensic tool to generate a report automatically.
   • BMake a second copy of the database and store it in a safe location.
   • CDocument the hash values of the extracted files and the chain of custody.
   • DPrint the database contents and have the suspect sign the printout.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are examining a suspect's iPhone and find a messaging app that uses iCloud backup. The app's local database is encrypted with a key stored in the Keychain. You have the device passcode and access to the suspect's iCloud account. Which approach is most likely to provide the most complete set of messages?

   • AAttempt to extract the encryption key from the iCloud backup to decrypt the local database.
   • BUse only the iCloud backup, as it is likely to contain a more complete set of messages than the local database.
   • CUse the device passcode to access the Keychain and decrypt the local database, and also download the iCloud backup to compare and fill in any gaps.
   • DUse only the local database, as it is the primary source of evidence and the iCloud backup may be incomplete.
   Reveal Solution Discussion Select an answer first