Mobile Device Application Analysis GASF Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which metadata field is most commonly used to establish when an application was first installed on a device?

   • AThe app's icon file creation date
   • BThe app's version number
   • CThe app's last modified date
   • DThe app's first install time
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are examining a suspect's Android device and find a messaging app that stores data in multiple locations: the app's sandboxed internal storage, external storage (SD card), and a cloud backup. The device is not rooted, and you have a logical extraction. Which approach is most likely to provide the most complete picture of the app's data?

   • AFocus only on the app's sandboxed internal storage, as it is the primary location for app data.
   • BUse only the cloud backup, as it is likely to contain the most complete set of data.
   • CAttempt to root the device to access the app's sandboxed internal storage, as it is the only way to get the data.
   • DAnalyze the app's sandboxed internal storage from the logical extraction, and also examine the external storage and cloud backup for additional data.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are examining an iPhone and find a messaging app that uses end-to-end encryption. The app's local database is encrypted with a key that is stored in the device's Keychain. You have the device passcode. What is the most effective way to access the app's message content?

   • AAnalyze the app's network traffic to intercept messages before they are encrypted.
   • BPerform a brute-force attack on the app's database to recover the encryption key.
   • CUse a forensic tool that can access the Keychain with the device passcode to retrieve the encryption key, then decrypt the app's database.
   • DAttempt to extract the encryption key from the app's sandboxed documents directory.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When analyzing a social media app, which artifact is most likely to reveal the user's friends or connections?

   • AThe app's database tables for contacts or friends
   • BThe app's preferences file
   • CThe app's notification history
   • DThe app's cache folder
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During a forensic examination of an Android device, you need to recover a suspect's messaging app history. The app stores its database in its sandboxed internal storage directory (/data/data/com.example.messenger/databases/). The device is rooted and you have a full physical image. Which approach should you take to ensure the most complete and forensically sound extraction of the app's data?

   • APerform a logical extraction using ADB backup, which will include the app's sandboxed data by default.
   • BUse a forensic tool to parse the app's SQLite database directly from the physical image, then validate the extracted data against known hash values.
   • CBoot the device and use the app's built-in export function to create a backup of the chat history to external storage.
   • DCopy the entire /data/data/com.example.messenger/ directory to an external SD card using a file manager app.
   Reveal Solution Discussion Select an answer first