GASF Android Forensics Techniques 3

Question 1

What is the Android 'tombstone' file and what forensic value does it provide?

Accepted Answer

A crash dump generated when a native process crashes, containing register state and stack trace

Answer

A log of deleted contacts

Answer

A record of factory resets

Answer

A file recording uninstalled applications

Question 2

What does TWRP (Team Win Recovery Project) enable in Android forensics?

Accepted Answer

A custom recovery environment that allows full partition imaging without booting the main OS

Answer

Cloud backup of Android data

Answer

A tool for bypassing Google account verification

Answer

An ADB-over-Wi-Fi solution

Question 3

Which content provider URI would an examiner query to retrieve call log data from an Android device via ADB?

Accepted Answer

content://call_log/calls

Answer

content://telephony/calls

Answer

content://android.calls/log

Answer

content://com.android.dialer/calls

Question 4

What is the significance of the 'build.prop' file in Android forensics?

Accepted Answer

It contains device build information including model, Android version, and build fingerprint

Answer

It stores user account credentials

Answer

It holds app encryption keys

Answer

It records system update history

Question 5

Where does Android store notification history that can be forensically relevant?

Accepted Answer

/data/data/com.android.systemui/databases/notification_history.db

Answer

/data/system/notification_log.db

Answer

/data/system/notification_log.xml

Answer

/sdcard/Notifications/

Question 6

What is Fastboot mode on Android and how is it used in forensic acquisition?

Accepted Answer

A low-level protocol for flashing partitions; used to boot custom recovery or forensic images without writing to storage

Answer

A quick boot mode for faster startups; not used forensically

Answer

An emergency recovery mode; used to bypass encryption

Answer

A developer mode; used for ADB access over Wi-Fi