Mobile Device Application Analysis GASF Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a characteristic of shared storage on a mobile device?

   • AIt is typically used for media files and documents that multiple apps can access.
   • BIt is accessible only by the app that created the data.
   • CIt is stored only on removable SD cards.
   • DIt is encrypted with a per-app key that cannot be decrypted by forensic tools.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   You have extracted a database from a suspect's phone and need to present it in court. The defense argues that the database may have been altered during extraction. Which evidence would best refute this claim?

   • AThe forensic tool used is widely accepted in the industry.
   • BThe database was extracted using a write blocker.
   • CThe hash value of the original database matches the hash of the extracted copy.
   • DThe examiner has many years of experience.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are examining a productivity app on a suspect's device that stores documents in a proprietary format. The app also has a companion cloud service. You have extracted the app's local data. What is the most effective way to analyze the documents?

   • ASearch the device's unallocated space for remnants of the documents in a standard format.
   • BAccess the companion cloud service using the suspect's credentials to retrieve the documents in a standard format.
   • CConvert the proprietary format to a standard format using a third-party tool without understanding the underlying structure.
   • DUse the app's documentation or reverse engineering to understand the proprietary format, then parse the local data accordingly.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are investigating a case where a suspect deleted a messaging app and its data from an Android device. You have a physical image of the device. The app used a SQLite database in its sandboxed directory. You also have a cloud backup from the suspect's account that contains an older version of the app's database. Which combination of techniques is most likely to recover the most complete set of messages?

   • AUse only the cloud backup, as it is more likely to contain a complete set of messages than the physical image.
   • BCarve the physical image for SQLite pages to recover deleted messages, and also analyze the cloud backup to fill in any gaps.
   • CAttempt to recover the deleted app's data from the device's cache partition, as it may contain a copy of the database.
   • DUse only the physical image, as it is the primary source of evidence and the cloud backup may be unreliable.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important to document the hash values of application data in a forensic report?

   • ATo prove the data was encrypted.
   • BTo identify the app that created the data.
   • CTo show the data's file size.
   • DTo allow others to verify the integrity of the evidence.
   Reveal Solution Discussion Select an answer first