You are analyzing an iOS device and find a plist file that contains a list of recently used apps. You also find a system log that shows app launches. How can you use these artifacts together to reconstruct user activity?

Use the plist file alone to determine the exact time each app was used.

Ignore the system log because it is not relevant to app usage.

Use the system log to determine the user's location at the time of app usage.

Correlate the app usage times from the plist with the system log to establish a timeline of app usage.

You are analyzing an iOS device backup. You need to find the user's Safari browsing history. Where would you expect to locate the History.db file in the backup?

In the 'Library/Safari' directory of the root domain.

In the 'AppDomainGroup' group container for Safari.

In the 'Documents' folder of the Safari app container.

In the 'Library/Caches' directory of the root domain.

Which of the following is a proper technique for preserving file system artifacts during a forensic examination?

Creating a bit-for-bit image of the device storage

Browsing the device to view files

Copying only the files that appear relevant

GIAC Advanced Smartphone Forensics

Domain 2Objective 1

Mobile Device File System Artifacts GASF Practice Questions (Page 8)

Part of the Mobile Device File System Analysis domain, which makes up ~37% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 36–38

36expert · hard
You are analyzing an iOS device and find a plist file that contains a list of recently used apps. You also find a system log that shows app launches. How can you use these artifacts together to reconstruct user activity?
Select an answer first
37application · medium
You are analyzing an iOS device backup. You need to find the user's Safari browsing history. Where would you expect to locate the History.db file in the backup?
Select an answer first
38foundation · easy
Which of the following is a proper technique for preserving file system artifacts during a forensic examination?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.