You are examining a logical extraction from an Android device. You find a file named 'downloads.db' in the /data/data/com.android.providers.downloads/databases/ directory. What type of artifact is this and what can it reveal?

It is a database containing metadata about files downloaded by the system download manager, including URIs, file paths, and timestamps.

It is a configuration file for the download manager app, containing settings and preferences.

It is a log file that records every network request made by the device.

It is a cache of downloaded files themselves, stored for offline access.

You are analyzing an Android device image. You find a file at '/data/system/users/0/accounts_de.db'. What is the significance of this artifact?

It contains account credentials and sync settings for the primary user profile.

It is a database of deleted accounts that can be recovered.

It is a log of all authentication attempts on the device.

It is a cache of contact names from the user's accounts.

During a forensic examination, you find a file with the extension '.db-wal' next to a SQLite database. What does this file indicate?

The database is a backup copy and the WAL file is a temporary file.

The database is using write-ahead logging, and the WAL file contains recent transactions that may not yet be checkpointed into the main database.

The database is corrupted and needs repair.

The database is encrypted and the WAL file contains the encryption key.

You are examining an iOS device that has been jailbroken. You find a file system artifact that appears to be a log of user activities. However, the device's system time was changed by the user. How should you handle the timestamps in this log?

Ignore the timestamps because they are unreliable.

Convert the timestamps to UTC and assume they are correct.

Use the timestamps as-is and present them in the report without any adjustment.

Compare the timestamps with other artifacts to establish a timeline and identify any discrepancies.

During a forensic examination of an Android device, you need to preserve the logical files from the /data partition without altering the device. The device is rooted and you have ADB access. Which approach best preserves the integrity of the file system artifacts?

Create a full physical image of the userdata partition using 'dd' over ADB, then hash the image.

Use 'adb backup' to create an Android backup archive of the device, then extract the /data files.

Use 'adb pull' to copy the entire /data directory to an evidence drive, then hash the copied files.

Copy the /data partition using 'cp -r' to an external SD card, then document the file listing.

GIAC Advanced Smartphone Forensics

Domain 2Objective 1

Mobile Device File System Artifacts GASF Practice Questions (Page 7)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 31–35

31application · medium
You are examining a logical extraction from an Android device. You find a file named 'downloads.db' in the /data/data/com.android.providers.downloads/databases/ directory. What type of artifact is this and what can it reveal?
Select an answer first
32application · medium
You are analyzing an Android device image. You find a file at '/data/system/users/0/accounts_de.db'. What is the significance of this artifact?
Select an answer first
33application · medium
During a forensic examination, you find a file with the extension '.db-wal' next to a SQLite database. What does this file indicate?
Select an answer first
34expert · hard
You are examining an iOS device that has been jailbroken. You find a file system artifact that appears to be a log of user activities. However, the device's system time was changed by the user. How should you handle the timestamps in this log?
Select an answer first
35application · medium
During a forensic examination of an Android device, you need to preserve the logical files from the /data partition without altering the device. The device is rooted and you have ADB access. Which approach best preserves the integrity of the file system artifacts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.