Mobile Device Application Analysis GASF Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common challenge when recovering deleted data from modern mobile devices?

   • ADeleted data is automatically sent to the cloud.
   • BDeleted data is stored in a separate hidden partition that is inaccessible.
   • CThe data is always overwritten immediately after deletion.
   • DFile-based encryption may render deleted data unreadable without the user's passcode.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You have completed the analysis of a suspect's messaging app and need to prepare a report for legal proceedings. Which approach best ensures the report is clear, concise, and legally defensible?

   • AUse technical jargon throughout the report to demonstrate expertise and precision.
   • BFocus on the most incriminating messages and omit any data that may be exculpatory.
   • CProvide only the raw data extracted from the app, as it is the most objective form of evidence.
   • DInclude a summary of findings, a detailed methodology, and visualizations of the data, with references to the original evidence.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which combination of evidence sources would be most useful to correlate to confirm a user's physical location at a specific time?

   • AGPS data and a social media check-in
   • BCall logs and device wallpaper
   • CApp usage logs and battery temperature
   • DText messages and app icon colors
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When analyzing a messaging app's database, which type of data would be most useful for reconstructing a user's conversation timeline?

   • AThe app's version number
   • BThe message timestamps
   • CThe device's IMEI number
   • DThe app's icon color
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are examining an Android device and need to extract data from a social media app. The app stores some data in its sandboxed internal storage and some in external/shared storage. Which extraction method will capture both locations?

   • APerform a logical extraction that includes the app's sandbox and shared storage.
   • BManually copy the app's folder from the device's internal storage.
   • CUse ADB backup to extract the app's data, which includes both internal and external storage.
   • DPerform a file system extraction that only includes the app's sandbox directory.
   Reveal Solution Discussion Select an answer first