Free GASF Certification Overview Questions and Answers

Question 1

Based on the image below, which file system is being examined?

Accepted Answer

Chinese knock-off

Answer

In smartphone forensics, if a device's file system or characteristics do not align with standard Android, iOS, Windows, or Blackberry structures, it often points to a less common or proprietary system. 'Chinese knock-off' devices frequently utilize highly customized or simplified operating systems and file structures that deviate significantly from mainstream platforms, making them distinct during forensic examination.

Question 2

What type of acquisition is being examined in the image below?

Accepted Answer

Android physical

Answer

The term 'Download Mode' is a specific boot mode primarily associated with Android devices, particularly Samsung, that allows for flashing firmware or performing low-level operations. A physical acquisition involves extracting a bit-for-bit copy of the device's memory, which is a common and robust forensic technique for Android devices when they are placed in Download Mode.

Question 3

Which of the following files contains details regarding the encryption state of an iTunes backup file?

Accepted Answer

Manifest.plist

Answer

The `Manifest.plist` file within an iTunes backup is crucial for forensic analysis as it contains metadata about the backup itself, including whether the backup is encrypted. This file stores various properties and settings, and its presence and content are key indicators for determining the encryption status and other important details of the backup.

Question 4

In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

Accepted Answer

BlackBerry Link ID/password

Answer

For BlackBerry OS 10 handsets, decrypting the contents often requires not only the device passcode but also the BlackBerry Link ID and password. This is because BlackBerry Link is the primary software used for managing and backing up data, and the encryption keys can be tied to this account for enhanced security, especially when dealing with enterprise-managed devices or backups.

Question 5

The device pictured below is in Download Mode to attempt a physical acquisition. What can be ascertained by viewing the Android boot screen below?

Accepted Answer

The Original/Factory ROM is booting

Answer

When an Android device is in Download Mode, the boot screen typically displays information about the device's current software state. If the screen indicates that the 'Original/Factory ROM is booting,' it means the device is running its unmodified, official firmware. This suggests that no custom ROMs have been installed or that the device has been restored to its factory state.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

Free GASF Certification Overview Questions and Answers