Mobile Device File System Artifacts GASF Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An examiner finds a log entry showing that a phone was unlocked at 2:00 AM. What can this artifact indicate about user activity?

   • AThe phone was factory reset
   • BThe phone was powered off
   • CThe user was actively using the phone at that time
   • DThe phone was in airplane mode
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the Android file system, where are user-installed application databases typically stored?

   • A/data/data/<package_name>/databases/
   • B/system/app/
   • C/cache/
   • D/sdcard/Android/data/
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an internal investigation, you acquire an Android device and mount the userdata partition read-only. You find a SQLite database in /data/data/com.example.chat/databases/ with a messages table. The table has a column named 'deleted' with values 0 or 1. Several rows have deleted=1 but the corresponding message text is still present. What is the most appropriate interpretation of this artifact?

   • AThe messages were deleted by the user but the database file was not vacuumed, so they are still in the table but hidden from the app UI.
   • BThe messages were permanently removed from the device and cannot be recovered by any forensic method.
   • CThe messages were deleted from the app's server but remain only as cached copies in the database.
   • DThe messages were logically deleted from the app's perspective but may still be recoverable from the database free pages or WAL file.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of a file system metadata artifact on a mobile device?

   • AA cached web page
   • BThe content of a text message
   • CA system log entry
   • DA deleted photo's file creation timestamp
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You are analyzing an iOS backup and find a file named 'com.apple.locationd' in the RootDomain/Library/Preferences/ directory. What does this file likely contain?

   • ALocation services preferences and possibly cached location data.
   • BThe user's GPS coordinates at all times.
   • CA list of all apps that have requested location access.
   • DA log of all location-based notifications.
   Reveal Solution Discussion Select an answer first