Mobile Device Application Analysis GASF Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are analyzing a fitness tracking app on a suspect's phone. The app records steps, heart rate, and GPS routes. You need to determine if the suspect was at a specific location at a specific time. Which data from the app is most useful?

   • AThe step count data for that day.
   • BThe app's installation date.
   • CThe GPS route logs with timestamps.
   • DThe heart rate data for that day.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You are investigating a suspect's use of a dating app. The app stores profile information, chat messages, and location data. The app uses end-to-end encryption for messages, but the local database is not encrypted. You have a physical image of the device. Which data is most likely to be recoverable and useful?

   • AThe chat messages, because the local database is not encrypted.
   • BThe encryption keys, because they are stored on the device.
   • CThe location data, because it is stored in the cloud.
   • DThe profile information, because it is stored in the app's sandbox.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You have extracted a database from a suspect's iPhone and need to present it as evidence in court. The database was extracted using a forensic tool that also generated a hash of the file. During analysis, you notice that the database's internal integrity check (e.g., PRAGMA integrity_check) fails. What is the most appropriate action?

   • ADocument the integrity check failure in your report and explain the potential causes, such as deleted data or corruption, while still presenting the recovered data with appropriate caveats.
   • BUse a different forensic tool to extract the database again, as the failure is likely due to a tool error.
   • CDiscard the database and rely on other evidence, as the integrity check failure makes the data inadmissible.
   • DRe-extract the database from the device to obtain a clean copy that passes the integrity check.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which forensic technique is commonly used to recover deleted messages from a messaging app's SQLite database?

   • AAnalyzing the app's network traffic logs
   • BCarving unallocated space for SQLite records
   • CExamining the app's icon file
   • DChecking the device's call log
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are analyzing a suspect's iPhone backup and find a messaging app's database with a 'message' table containing 'text', 'timestamp', and 'is_deleted' columns. You also find a separate 'contacts' table with 'phone_number' and 'name'. To reconstruct a timeline of communications, which action is most appropriate?

   • AExport both tables to separate CSV files and include them as separate exhibits in the report without further analysis.
   • BExtract only the 'message' table and sort by timestamp, ignoring the 'contacts' table because it is not relevant to the timeline.
   • CJoin the 'message' and 'contacts' tables on the phone number to correlate messages with contacts, then sort by timestamp to build a chronological timeline.
   • DSearch for deleted messages in the 'message' table and report only those, as they are the most relevant to the investigation.
   Reveal Solution Discussion Select an answer first