You are investigating a case involving an iPhone. You have a file system image. You find a SQLite database in the 'Library/SMS' directory named 'sms.db'. The 'message' table has a column 'date' that appears to be a Unix epoch in seconds. You also find a 'date_read' column. How should you interpret these timestamps to reconstruct the user's messaging activity?

Convert both timestamps to UTC and compare them to determine when messages were sent and read.

Treat the date column as the read time and date_read as the sent time.

Treat the timestamps as local time and convert to UTC using the device's time zone.

Treat the timestamps as Mac Absolute Time and convert accordingly.

What is the primary purpose of interpreting file system artifacts in a forensic examination?

To create a backup of the device

To reconstruct user activity and device usage

Which of the following best describes the hierarchical organization of file system artifacts on a mobile device?

A random structure where files are stored without any organization

A structure based solely on file size

A flat structure where all artifacts are stored in a single directory

A tree-like structure with directories and subdirectories that group related data

You are analyzing an iOS device image. You find a file named 'com.apple.locationd.plist' in the mobile/Library/Preferences/ directory. What type of artifact is this and what can it reveal?

It is a database of all GPS coordinates ever recorded by the device.

It is a log of all location-based app requests.

It is a cache of Wi-Fi network locations.

It is a preference file for the location daemon, containing settings such as location services enabled status and possibly cached locations.

You are examining an iOS backup and need to find the user's voicemail messages. Which domain and path would you look in?

HomeDomain/Library/SMS/voicemail.db

RootDomain/Library/Voicemail/voicemail.db

MediaDomain/Library/Voicemail/voicemail.db

HomeDomain/Library/Voicemail/voicemail.db

GIAC Advanced Smartphone Forensics

Domain 2Objective 1

Mobile Device File System Artifacts GASF Practice Questions (Page 2)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 6–10

6expert · medium
You are investigating a case involving an iPhone. You have a file system image. You find a SQLite database in the 'Library/SMS' directory named 'sms.db'. The 'message' table has a column 'date' that appears to be a Unix epoch in seconds. You also find a 'date_read' column. How should you interpret these timestamps to reconstruct the user's messaging activity?
Select an answer first
7foundation · easy
What is the primary purpose of interpreting file system artifacts in a forensic examination?
Select an answer first
8foundation · easy
Which of the following best describes the hierarchical organization of file system artifacts on a mobile device?
Select an answer first
9application · medium
You are analyzing an iOS device image. You find a file named 'com.apple.locationd.plist' in the mobile/Library/Preferences/ directory. What type of artifact is this and what can it reveal?
Select an answer first
10application · medium
You are examining an iOS backup and need to find the user's voicemail messages. Which domain and path would you look in?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.