Mobile Device File System Artifacts GASF Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are documenting a file system artifact from an Android device. You have extracted a SQLite database that contains deleted records. What is the best practice for preserving this artifact for analysis?

   • ACopy the entire database file, including the WAL and SHM files, to an evidence container.
   • BRun a SQLite vacuum command to reclaim free space before copying.
   • CExport only the active records to a CSV file and hash the CSV.
   • DCopy only the main database file, ignoring the WAL and SHM files.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   While examining an Android device, you find a file named 'cache.db' in the /data/data/com.example.browser/cache/ directory. What does this file likely contain?

   • AThe browser's download history
   • BCached web content such as images, scripts, and HTML pages
   • CThe browser's saved passwords
   • DThe browser's bookmarks and history
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are examining an Android device image. You find a file at '/data/system/packages.xml'. What is the significance of this artifact?

   • AIt is a cache of app icons and names for the launcher.
   • BIt is a log of all app launches and crashes.
   • CIt is a database of all APK files stored on the device.
   • DIt is a list of installed packages, including permissions, version codes, and installation timestamps.
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   You are analyzing an Android device and find a SQLite database that appears to be from a messaging app. The database contains a table named 'messages' with a column 'timestamp' that stores Unix epoch time in seconds. You also find a file named 'com.example.messenger' in the /data/data directory. What is the most likely relationship between these two artifacts?

   • AThe database is stored within the app's data directory, and the timestamp column records when messages were sent or received.
   • BThe database is a system database and the app directory is unrelated.
   • CThe database is a cache file that contains temporary data.
   • DThe database is a backup of the app's APK file.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an examination of an Android device, you locate a SQLite database in /data/data/com.example.socialapp/databases/ that contains a table named 'messages'. The table has columns: _id, thread_id, body, timestamp, deleted_flag. You notice that many rows have deleted_flag=1. What is the most appropriate interpretation of these rows?

   • AThe rows are definitely remnants from a previous database version and have no evidentiary value.
   • BThe rows are encrypted and require a cloud key to interpret.
   • CThe rows are soft-deleted records that may still be recoverable from the database's freelist or WAL file.
   • DThe rows were intentionally deleted by the user and are no longer recoverable.
   Reveal Solution Discussion Select an answer first