GASF Android Forensics Techniques

Question 1

What is the default file system used by most modern Android devices for internal storage?

Accepted Answer

EXT4

Answer

EXT4 (Fourth Extended Filesystem) is the most widely used file system for Android internal storage, though F2FS is increasingly adopted.

Question 2

Where does Android store SQLite databases for most applications by default?

Accepted Answer

/data/data/<package_name>/databases/

Answer

Android stores app-specific SQLite databases in /data/data/<package_name>/databases/, accessible only with root privileges or ADB backup.

Question 3

What does ADB (Android Debug Bridge) allow forensic examiners to do on Android devices?

Accepted Answer

Communicate with a device to extract data, run commands, and install tools

Answer

ADB provides a command-line interface to interact with Android devices, enabling file transfers, shell access, and backup creation for forensic purposes.

Question 4

Which Android partition contains the operating system and pre-installed system apps?

Accepted Answer

/system

Answer

The /system partition is a read-only mount containing the Android OS, framework libraries, and pre-installed system applications.

Question 5

What is 'ADB backup' and what is its limitation for forensic purposes?

Accepted Answer

An app-level backup that excludes apps with the allowBackup=false flag

Answer

ADB backup creates app data archives, but apps that set android:allowBackup='false' in their manifest are excluded, limiting forensic coverage.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Android Forensics Techniques