During a forensic examination of an Android device, you find a file named 'usage-history.xml' in the /data/system/ directory. What is this artifact and what does it reveal?

It is a log of app usage events, including app launches and screen on/off times.

It is a configuration file for the system UI, controlling which apps appear in the launcher.

It is a cache of recently used files, similar to Windows jump lists.

It is a backup of the user's app preferences.

You are examining an iOS device and find a plist file that contains a list of Wi-Fi network names and their last connection times. You also find a system log that shows network connections. How can you use these artifacts together to reconstruct user activity?

Use the plist file alone to determine the user's exact location at all times.

Use the system log to determine the user's IP address and then trace their physical location.

Ignore the system log because it is not relevant to Wi-Fi connections.

Correlate the Wi-Fi connection times with the system log to establish a timeline of the user's locations.

During a forensic examination of an Android device, an examiner locates a SQLite database file that contains deleted chat messages. Which type of file system artifact does this represent?

A file system metadata artifact

During a forensic examination of an Android device, you discover a SQLite database that contains deleted chat messages. You need to preserve the evidence in a way that maintains its integrity for court. Which of the following actions is most appropriate?

Run a SQLite recovery tool directly on the device to extract deleted records.

Copy the database file to an evidence drive using a write blocker.

Create a forensic image of the entire device and then extract the database from the image.

Take a photo of the database file and its metadata with your phone.

You are a forensic examiner working on a case involving an iPhone. The device is passcode-protected and you have obtained a forensic image of the file system. You need to preserve and document artifacts related to the user's location history. You find a SQLite database named 'routined' in the 'Library/PrivateFrameworks' directory. What is the best approach to preserve this artifact?

Take a screenshot of the database contents and save it in the case file.

Export the relevant tables to a CSV file and hash the CSV.

Run a SQLite integrity check and then copy only the main database file.

Copy the entire 'routined' database file, along with its WAL and SHM files, to an evidence container and hash all three files.

GIAC Advanced Smartphone Forensics

Domain 2Objective 1

Mobile Device File System Artifacts GASF Practice Questions (Page 6)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 26–30

26application · medium
During a forensic examination of an Android device, you find a file named 'usage-history.xml' in the /data/system/ directory. What is this artifact and what does it reveal?
Select an answer first
27expert · hard
You are examining an iOS device and find a plist file that contains a list of Wi-Fi network names and their last connection times. You also find a system log that shows network connections. How can you use these artifacts together to reconstruct user activity?
Select an answer first
28foundation · easy
During a forensic examination of an Android device, an examiner locates a SQLite database file that contains deleted chat messages. Which type of file system artifact does this represent?
Select an answer first
29application · medium
During a forensic examination of an Android device, you discover a SQLite database that contains deleted chat messages. You need to preserve the evidence in a way that maintains its integrity for court. Which of the following actions is most appropriate?
Select an answer first
30expert · medium
You are a forensic examiner working on a case involving an iPhone. The device is passcode-protected and you have obtained a forensic image of the file system. You need to preserve and document artifacts related to the user's location history. You find a SQLite database named 'routined' in the 'Library/PrivateFrameworks' directory. What is the best approach to preserve this artifact?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.