Free GASF Additional Resources Questions and Answers

Question 1

The files pictured below from a BlackBerry OS10 file system have a unique file extension. What can be concluded about these files?

Accepted Answer

Files are protected by the file system, so changing the file system makes them less accessible

Answer

Files are encrypted to prevent them from being viewed without the decryption key

Answer

Files are encoded for secure transmitting of data

Answer

Files are located on a media card contain a unique file extension

Question 2

Where can an analysis find data to provide additional artifacts to support the evidence in the highlighted file?

Accepted Answer

internal.db-wal

Answer

browser2.db

Answer

sysmon2.db-shm

Answer

extenal.db

Question 3

As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device.

Which other file may provide you with additional information on applications that were accessed with the handset?

Accepted Answer

BlackBerry NV Items

Answer

Content Store

Answer

BBThumbs.dat

Question 4

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Accepted Answer

SMS messages

Answer

Deleted images

Answer

Contacts

Answer

Phone numbers

Question 5

Where can an analyst find data to provide additional artifacts to support the evidence in the highlighted file?

Accepted Answer

internal.db-wal

Answer

browser2.db

Answer

sysmon2.db-shm

Answer

external.db

Question 6

Which of the following is a unique 56 bit number assigned to a CDMA handset?

Accepted Answer

Mobile Station International Subscriber Directory Number (MSISDN)

Answer

Electronic Serial Number (ESN)

Answer

International Mobile Equipment Identifier (IMEI)

Question 7

Which of the following files provides the most accurate reflection of the device’s date/timestamp related to the last device wipe?

Accepted Answer

/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb

Answer

/private/var/mobile/Applications/com.apple.mobilesafari/Library/history.db

Answer

/private/var/mobile/Applications/com.viber/Library/Prefernces/com.viber.plist

Answer

/private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/pw.dat