Free GASF Core Topics Covered Questions and Answers

Question 1

Which artifact must be carved out manually when examining a file examining a file system acquisition of an Android device?

Accepted Answer

SMS messages

Answer

Deleted images

Answer

Contacts

Answer

Phone numbers

Question 2

When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

Accepted Answer

FAT

Answer

HFS

Answer

NTFS

Answer

Yaffs2

Question 3

Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?

Accepted Answer

Signature-based detection

Answer

Specific-based malware detection

Answer

Behavioral-based detection

Answer

Cloud based malware detection

Question 4

Which of the following is required in addition to the Apple ID of the custodian to access IOS backup files that are stored in ICloud?

Accepted Answer

Device passcode

Answer

iTunes password

Answer

Manifest.plist

Answer

Keychain-backup.plist

Question 5

In 2015, Apples iTunes store was found to be hosting several malicious applications that were infected as a result of hacked version of the developer toolkit used to create applications. Which Apple developer suite was targeted?

Accepted Answer

Xcode

Answer

ADB

Answer

Momentics

Answer

Xamarin

Question 6

An Android user is known to use Facebook to communicate with other parties under examination. There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?

Accepted Answer

dmappmgr.db

Answer

com.android.chrome/app_chrome/Default/Local Storage

Answer

/data/system/packages.xml

Answer

AndroidManifest.xml

Question 7

Physical Analyzer provides a function to narrow down a search based on a timestamp, a type, a party or date. What is the name of this advanced searching capability?

Accepted Answer

Timeline

Answer

Watchlist Editor

Answer