GASF iOS Forensics Techniques 2

Question 1

Where is the consolidated.db or Cache.SQLiteDb file located that stores location history on older iOS versions?

Accepted Answer

/var/mobile/Library/Caches/locationd/

Answer

/var/mobile/Library/Maps/

Answer

/System/Library/Location/

Answer

/private/var/db/locationd/

Question 2

Which tool is commonly used to perform a full file system extraction from a jailbroken iOS device?

Accepted Answer

SSH with tar or dd

Answer

iMazing

Answer

Cellebrite UFED

Answer

iExplorer

Question 3

What does the iOS 'sysdiagnose' archive contain that is useful for forensic analysis?

Accepted Answer

System logs, crash reports, and diagnostic data

Answer

Encrypted keychain data

Answer

Raw NAND flash dump

Answer

Full backup of user data

Question 4

Which iOS plist file within an app bundle contains metadata about app permissions and capabilities?

Accepted Answer

Info.plist

Answer

Entitlements.plist

Answer

Settings.plist

Answer

AppMeta.plist

Question 5

What is 'GrayKey' in the context of iOS forensics?

Accepted Answer

A hardware device used to brute-force iOS passcodes

Answer

An open-source jailbreak tool

Answer

An iCloud extraction service

Answer

A file system analysis framework

Question 6

Which iOS feature, when enabled, makes full-disk encryption active using a key derived from the user's passcode?

Accepted Answer

Data Protection

Answer

Touch ID

Answer

Find My iPhone

Answer

Secure Enclave