You are examining an iOS device and need to extract data from a messaging app. The app stores its database in the app's sandbox, but you also find related data in the device's keychain and in a shared app group container. You have a full file system image. Which extraction approach ensures you capture all relevant data?

Extract the keychain only, as it contains the encryption keys and tokens.

Extract the entire app sandbox, the keychain, and any app group containers associated with the app.

Extract only the app sandbox, as it contains the primary database.

Extract the app group container only, as it contains shared data from all apps.

Which technique is most effective for recovering deleted files from a mobile device's flash memory?

Examining the device's system logs

Analyzing the device's network traffic

Physical extraction and data carving

Logical extraction of the file system

Which of the following is a best practice for validating the authenticity of application data?

Comparing the data's hash value to a known-good source.

Using the data's creation timestamp as proof of authenticity.

Relying solely on the file extension to determine the file type.

Assuming that data from a trusted app is always authentic.

What does the 'permissions' metadata of an application indicate to a forensic examiner?

The exact date and time the app was used.

The resources and data the app is allowed to access.

The hardware capabilities of the device.

GIAC Advanced Smartphone Forensics

Domain 3Objective 1

Mobile Device Application Analysis GASF Practice Questions (Page 8)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 36–40

36foundation · easy
Which forensic tool is specifically designed to extract application data from a mobile device while preserving the integrity of the evidence?
Select an answer first
37expert · hard
You are examining an iOS device and need to extract data from a messaging app. The app stores its database in the app's sandbox, but you also find related data in the device's keychain and in a shared app group container. You have a full file system image. Which extraction approach ensures you capture all relevant data?
Select an answer first
38foundation · easy
Which technique is most effective for recovering deleted files from a mobile device's flash memory?
Select an answer first
39foundation · easy
Which of the following is a best practice for validating the authenticity of application data?
Select an answer first
40foundation · easy
What does the 'permissions' metadata of an application indicate to a forensic examiner?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Mobile Device Application Analysis GASF Practice Questions (Page 8)

Questions 36–40

Which forensic tool is specifically designed to extract application data from a mobile device while preserving the integrity of the evidence?

Which technique is most effective for recovering deleted files from a mobile device's flash memory?

Which of the following is a best practice for validating the authenticity of application data?

What does the 'permissions' metadata of an application indicate to a forensic examiner?

Keep studying — Mobile Device Application Analysis