GASF Android Forensics Techniques 3

Question 1

What is the Android 'tombstone' file and what forensic value does it provide?

Accepted Answer

A crash dump generated when a native process crashes, containing register state and stack trace

Answer

Tombstone files are native crash dumps stored in /data/tombstones/ containing register states, stack traces, and memory maps useful for malware or incident analysis.

Question 2

What does TWRP (Team Win Recovery Project) enable in Android forensics?

Accepted Answer

A custom recovery environment that allows full partition imaging without booting the main OS

Answer

TWRP is a custom recovery that provides a touch-based interface allowing examiners to create full partition images and access the device outside of the normal Android OS.

Question 3

Which content provider URI would an examiner query to retrieve call log data from an Android device via ADB?

Accepted Answer

content://call_log/calls

Answer

The content://call_log/calls URI queries the Android Call Log content provider, returning incoming, outgoing, and missed call records.

Question 4

What is the significance of the 'build.prop' file in Android forensics?

Accepted Answer

It contains device build information including model, Android version, and build fingerprint

Answer

The build.prop file contains device metadata like manufacturer, model, Android version, and build fingerprint, essential for establishing device identity in forensic reports.

Question 5

Where does Android store notification history that can be forensically relevant?

Accepted Answer

/data/data/com.android.systemui/databases/notification_history.db

Answer

Android's SystemUI stores notification history in a SQLite database within its app data directory, containing records of past notifications with timestamps.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Android Forensics Techniques 3