Free GASF Core Topics Covered Questions and Answers

Question 1

Which artifact must be carved out manually when examining a file examining a file system acquisition of an Android device?

Accepted Answer

SMS messages

Answer

When performing a file system acquisition of an Android device, deleted SMS messages often need to be manually carved out from the raw data. Unlike some other data types that might be more readily recovered from active databases, deleted SMS messages can reside in fragmented or unallocated space within database files, requiring specialized carving techniques to reconstruct them.

Question 2

When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

Accepted Answer

FAT

Answer

When conducting forensic analysis of an associated media card, such as an SD card, the FAT (File Allocation Table) file system format is most commonly expected. FAT32, a variant of FAT, has been the prevalent file system for removable storage devices due to its widespread compatibility across various operating systems and devices, making it a standard for media cards.

Question 3

Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?

Accepted Answer

Signature-based detection

Answer

Cellebrite Physical Analyzer using Bit Defender to scan for malware by flagging files with known bad hash values is a classic example of signature-based detection. This method relies on a database of known malware signatures, such as unique hash values, to identify malicious files by comparing them against the collected data from the device.

Question 4

Which of the following is required in addition to the Apple ID of the custodian to access IOS backup files that are stored in ICloud?

Accepted Answer

Device passcode

Answer

To access iOS backup files stored in iCloud, in addition to the Apple ID of the custodian, the device passcode is often required. This is a critical security measure implemented by Apple to protect user data. It ensures that even with the Apple ID, unauthorized access to encrypted backups is prevented without the device's unlock code, adding an extra layer of security.

Question 5

In 2015, Apples iTunes store was found to be hosting several malicious applications that were infected as a result of hacked version of the developer toolkit used to create applications. Which Apple developer suite was targeted?

Accepted Answer

Xcode

Answer

In 2015, Apple's iTunes store was indeed found to be hosting malicious applications that were infected due to a hacked version of the developer toolkit. The specific Apple developer suite targeted in this incident was Xcode, which is the integrated development environment (IDE) used by developers to create applications for Apple platforms.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

Free GASF Core Topics Covered Questions and Answers