You are documenting a file system artifact found on a mobile device. Which of the following is the most important information to record?

The file's content and its hash value

The file's creation date and the app that created it

The file's owner and permissions

The file's path, size, timestamps, and hash value

You are examining a file system image from an iPhone. You find a file named 'com.apple.MobileSMS.plist' in the mobile/Library/Preferences/ directory. What does this artifact reveal?

It contains the actual SMS message content.

It is a cache of contact names used in messages.

It is a log of all incoming and outgoing calls.

It contains settings for the Messages app, such as the last active phone number and iMessage account information.

During an iOS forensic examination, you find a plist file that contains a list of recently opened documents. Which type of artifact is this?

A cache file that can be safely ignored

A preference file that may indicate user activity

A database file that stores all user communications

A log file generated by the operating system

You are analyzing an Android device and find a file named 'com.facebook.katana' in the /data/data directory. What does this file represent?

The package directory for the Facebook app, containing its databases, preferences, and cache

A cache file for the Facebook app

A backup of the Facebook app's APK

A system log file for the Facebook app

Why is it important to document file system artifacts during a forensic examination?

To ensure the evidence can be presented in court

To reduce the amount of data stored

To make the artifacts easier to delete later

To speed up the examination process

GIAC Advanced Smartphone Forensics

Domain 2Objective 1

Mobile Device File System Artifacts GASF Practice Questions (Page 5)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 21–25

21application · medium
You are documenting a file system artifact found on a mobile device. Which of the following is the most important information to record?
Select an answer first
22expert · medium
You are examining a file system image from an iPhone. You find a file named 'com.apple.MobileSMS.plist' in the mobile/Library/Preferences/ directory. What does this artifact reveal?
Select an answer first
23application · medium
During an iOS forensic examination, you find a plist file that contains a list of recently opened documents. Which type of artifact is this?
Select an answer first
24application · medium
You are analyzing an Android device and find a file named 'com.facebook.katana' in the /data/data directory. What does this file represent?
Select an answer first
25foundation · easy
Why is it important to document file system artifacts during a forensic examination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.