GASF iOS Forensics Techniques

Question 1

Which iOS file system is used on devices running iOS 10.3 and later?

Accepted Answer

APFS

Answer

HFS+

Answer

FAT32

Answer

exFAT

Question 2

What is the primary purpose of the iOS Keychain in forensic investigations?

Accepted Answer

Storing encrypted credentials and tokens

Answer

Storing app usage statistics

Answer

Logging network connections

Answer

Managing app permissions

Question 3

Which directory on iOS contains the majority of third-party application data?

Accepted Answer

/var/mobile/Containers/Data/Application/

Answer

/System/Library/

Answer

/private/var/root/

Answer

/usr/share/

Question 4

What type of acquisition bypasses iOS security controls by exploiting vulnerabilities to gain raw disk access?

Accepted Answer

Chip-off acquisition

Answer

Logical acquisition

Answer

Cloud acquisition

Answer

Advanced logical acquisition

Question 5

Which iOS backup file contains the device's backup encryption key wrapped by the backup password?

Accepted Answer

Manifest.plist

Answer

Manifest.db

Answer

Info.plist

Answer

Status.plist

Question 6

What is the significance of the 'knowledgeC' database in iOS forensics?

Accepted Answer

It records device usage and app activity timelines

Answer

It stores Wi-Fi passwords

Answer

It logs iCloud sync events

Answer

It contains Safari browsing history