GASF Android Forensics Techniques

Question 1

What is the default file system used by most modern Android devices for internal storage?

Accepted Answer

EXT4

Answer

F2FS

Answer

YAFFS2

Answer

NTFS

Question 2

Where does Android store SQLite databases for most applications by default?

Accepted Answer

/data/data/<package_name>/databases/

Answer

/sdcard/Android/data/

Answer

/system/app/databases/

Answer

/cache/app/

Question 3

What does ADB (Android Debug Bridge) allow forensic examiners to do on Android devices?

Accepted Answer

Communicate with a device to extract data, run commands, and install tools

Answer

Decrypt encrypted storage partitions

Answer

Bypass Android FRP (Factory Reset Protection)

Answer

Access Secure Folder contents

Question 4

Which Android partition contains the operating system and pre-installed system apps?

Accepted Answer

/system

Answer

/data

Answer

/recovery

Answer

/cache

Question 5

What is 'ADB backup' and what is its limitation for forensic purposes?

Accepted Answer

An app-level backup that excludes apps with the allowBackup=false flag

Answer

A full disk image; limited by device battery life

Answer

A cloud backup limited to 5GB

Answer

A physical acquisition limited to 32GB

Question 6

What is Android Full Disk Encryption (FDE) and which key protects the Device Encryption Key (DEK)?

Accepted Answer

FDE encrypts the userdata partition; DEK is protected by the Key Encryption Key (KEK) derived from the passcode

Answer

FDE encrypts /sdcard; DEK is protected by a hardware token

Answer

FDE encrypts all partitions; DEK is stored in the bootloader

Answer

FDE encrypts app data only; DEK is stored in Trusted Execution Environment unprotected