GASF iOS Forensics Techniques 2

Question 1

Where is the consolidated.db or Cache.SQLiteDb file located that stores location history on older iOS versions?

Accepted Answer

/var/mobile/Library/Caches/locationd/

Answer

On older iOS versions, location history was cached in a SQLite database within the locationd folder under /var/mobile/Library/Caches/.

Question 2

Which tool is commonly used to perform a full file system extraction from a jailbroken iOS device?

Accepted Answer

SSH with tar or dd

Answer

On jailbroken iOS devices, examiners commonly use SSH combined with tar or dd commands to perform a full file system image.

Question 3

What does the iOS 'sysdiagnose' archive contain that is useful for forensic analysis?

Accepted Answer

System logs, crash reports, and diagnostic data

Answer

A sysdiagnose archive packages system logs, crash reports, spindumps, and various diagnostic files useful for forensic timeline reconstruction.

Question 4

Which iOS plist file within an app bundle contains metadata about app permissions and capabilities?

Accepted Answer

Info.plist

Answer

The Info.plist file in every iOS app bundle contains metadata including bundle ID, version, and required permission usage descriptions.

Question 5

What is 'GrayKey' in the context of iOS forensics?

Accepted Answer

A hardware device used to brute-force iOS passcodes

Answer

GrayKey is a commercial hardware device developed by Grayshift that exploits vulnerabilities to brute-force iOS device passcodes.

GASF - Giac Advanced Smartphone Forensics Practice Test