Free GASF Additional Resources Questions and Answers

Question 1

The files pictured below from a BlackBerry OS10 file system have a unique file extension. What can be concluded about these files?

Accepted Answer

Files are protected by the file system, so changing the file system makes them less accessible

Answer

BlackBerry OS10 uses a highly secure file system where files are often protected by the system's architecture and encryption, sometimes with unique file extensions. If the file system is altered or accessed outside the device's normal operating environment, these proprietary protections can render the files less accessible or unreadable without the proper decryption and system context, making them protected by the file system.

Question 2

Where can an analysis find data to provide additional artifacts to support the evidence in the highlighted file?

Accepted Answer

internal.db-wal

Answer

The `internal.db-wal` file is a Write-Ahead Log (WAL) file associated with an SQLite database, such as `internal.db`. WAL files store changes to the database before they are committed to the main database file, essentially acting as a transaction log. Therefore, examining the corresponding `internal.db-wal` file is essential to find additional artifacts or reconstruct recent activities related to the highlighted `internal.db` file.

Question 3

As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device.

Which other file may provide you with additional information on applications that were accessed with the handset?

Accepted Answer

BlackBerry NV Items

Answer

For legacy BlackBerry devices, if third-party applications are not explicitly listed, the BlackBerry NV (Non-Volatile) Items can provide additional information. NV Items store various device configurations, settings, and sometimes remnants of application data or usage. This can offer deeper insights into the device's history and applications that were accessed, even if not formally installed.

Question 4

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Accepted Answer

SMS messages

Answer

When performing a file system acquisition of an Android device, deleted SMS messages often need to be manually carved out from the raw data. Unlike some other data types that might be more readily recovered from active databases, deleted SMS messages can reside in fragmented or unallocated space within database files, requiring specialized carving techniques to reconstruct them.

Question 5

Where can an analyst find data to provide additional artifacts to support the evidence in the highlighted file?

Accepted Answer

internal.db-wal

Answer

The `internal.db-wal` file is a Write-Ahead Log (WAL) file associated with an SQLite database, such as `internal.db`. WAL files store changes to the database before they are committed to the main database file, essentially acting as a transaction log. Therefore, examining the corresponding `internal.db-wal` file is essential to find additional artifacts or reconstruct recent activities related to the highlighted `internal.db` file.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

Free GASF Additional Resources Questions and Answers