GASF App Data and Artifact Analysis

Question 1

Which format do most messaging and social media apps use to store local data on mobile devices?

Accepted Answer

SQLite databases

Answer

XML files

Answer

Plain text logs

Answer

JSON files

Question 2

What tool is commonly used to examine SQLite databases recovered from mobile devices?

Accepted Answer

DB Browser for SQLite

Answer

Wireshark

Answer

Autopsy's hex editor

Answer

Volatility Framework

Question 3

Where does WhatsApp typically store its message database on Android?

Accepted Answer

/data/data/com.whatsapp/databases/msgstore.db

Answer

/sdcard/WhatsApp/Databases/msgstore.db

Answer

/system/WhatsApp/messages.db

Answer

/data/media/WhatsApp/msgstore.db

Question 4

What encryption does WhatsApp use for its local msgstore.db on Android, and how can it be decrypted forensically?

Accepted Answer

WhatsApp-proprietary crypt12/crypt14/crypt15 encryption; decrypted using the key file stored at /data/data/com.whatsapp/files/key

Answer

AES-256-CBC; decrypted using the device IMEI as the key

Answer

RSA-2048; decrypted using the user's WhatsApp account password

Answer

No encryption; the database is plaintext

Question 5

Which artifact would reveal which apps were recently active in the foreground on an iOS device?

Accepted Answer

knowledgeC.db ZOBJECT table

Answer

Safari browsing history

Answer

Notes app database

Answer

Health app step data

Question 6

What is the forensic significance of 'WAL' (Write-Ahead Log) files found alongside SQLite databases?

Accepted Answer

WAL files contain recent uncommitted transactions that may hold data not yet written to the main database file

Answer

WAL files contain the database encryption key

Answer

WAL files are backup copies of the main database

Answer

WAL files contain index data for faster queries