GASF Android Forensics Techniques 2

Question 1

What is Android File-Based Encryption (FBE) and how does it differ from FDE?

Accepted Answer

FBE encrypts individual files with different keys allowing some data access before unlock; FDE encrypts the entire partition with one key

Answer

FBE encrypts individual files with different keys, enabling Direct Boot (access to some data before first unlock), while FDE encrypts the whole /data partition with a single key.

Question 2

Which Android log contains a record of installed, updated, and removed packages that is useful for forensics?

Accepted Answer

/data/system/packages.xml

Answer

The packages.xml file maintained by the Android Package Manager records all installed applications, their permissions, and installation paths.

Question 3

What is the purpose of Android's 'logcat' in a forensic investigation?

Accepted Answer

To capture real-time system and application log output

Answer

Logcat captures real-time system, application, and security log messages from Android's logging system, useful for investigating running processes and errors.

Question 4

Where does Android's SMS/MMS data get stored on most devices?

Accepted Answer

/data/data/com.android.providers.telephony/databases/mmssms.db

Answer

Android stores SMS and MMS messages in the mmssms.db SQLite database under the telephony content provider's data directory.

Question 5

What is 'Rooting' an Android device and why might it be necessary for forensic acquisition?

Accepted Answer

Gaining superuser (root) access; needed to access /data partition files that are otherwise inaccessible

Answer

Rooting grants superuser privileges, allowing access to protected /data partition directories that contain app data unavailable through standard ADB commands.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Android Forensics Techniques 2