Mobile Device Application Analysis GASF Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are analyzing an iOS device and find a third-party messaging app installed. The app's metadata shows an installation date that is three weeks after the user's first known contact with a suspect. However, the app's container contains chat databases with messages dated before the installation date. What is the most likely explanation?

   • AThe device clock was changed before the messages were sent, causing incorrect timestamps.
   • BThe app was sideloaded, and the installation date is when the sideloading tool was installed, not the app itself.
   • CThe app was restored from a backup, and the installation date reflects the restore, not the original install.
   • DThe messages were imported from another device via the app's cloud sync feature.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of using a write blocker during mobile device forensic extraction?

   • ATo bypass the device's lock screen.
   • BTo decrypt the device's data.
   • CTo speed up the data extraction process.
   • DTo prevent any modification to the device's storage during acquisition.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During a forensic examination of an Android device, you find that a suspect's messaging app database has been deleted. However, you have a full physical image of the device. Which technique is most likely to recover deleted records from the app's database?

   • ACheck the device's cloud backup for a copy of the app's database that may contain the deleted records.
   • BCarve the unallocated space of the physical image for SQLite database pages and reconstruct the deleted records.
   • CUse a file recovery tool to restore the deleted database file from the device's internal storage.
   • DSearch the app's cache directory for backups of the database that may have been created automatically.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common method used by mobile apps to encrypt their local data?

   • AStoring data in plain text in the app's sandbox
   • BUsing the device's hardware-backed keystore to encrypt data with AES
   • CUsing a simple XOR cipher
   • DUsing base64 encoding
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You are analyzing a suspect's smartphone and find a productivity app (e.g., note-taking) that syncs data to a cloud service. The local database contains notes, but some notes appear to be missing. You have the suspect's cloud account credentials. Which step is most appropriate to recover the missing notes?

   • AUse the app's 'sync now' feature to force the notes to download to the device.
   • BCheck the app's cache folder for temporary copies of the notes.
   • CCarve the unallocated space of the device for deleted notes.
   • DAccess the cloud service using the credentials and download the notes, documenting the process for legal review.
   Reveal Solution Discussion Select an answer first