GASF Cloud and Network Forensics for Mobile Devices 2

Question 1

What is the primary forensic value of Google Takeout data when physical device access is limited in a mobile investigation?

Accepted Answer

It contains exported user data from Google services including location history, app data, and communications

Answer

It provides raw firmware dumps of the Android device

Answer

It gives direct read access to Google's internal server logs for the target account

Answer

It allows investigators to remotely wipe the Android device for evidence preservation

Question 2

In mobile network forensics, what does an IMSI catcher (Stingray device) simulate in order to intercept mobile communications?

Accepted Answer

A mobile carrier's cell tower

Answer

A legitimate Wi-Fi access point

Answer

A Bluetooth pairing device

Answer

A GPS satellite signal

Question 3

Which file on Android devices stores Wi-Fi network configuration history including SSIDs that can establish a device's location history?

Accepted Answer

/data/misc/wifi/wpa_supplicant.conf (legacy) or WifiConfigStore.xml (modern)

Answer

/data/misc/wifi/WifiConfigStore.xml

Answer

/data/system/netpolicy.xml

Answer

/data/data/com.android.providers.settings/databases/settings.db

Question 4

Under US law, what legal process is typically required to obtain message content (as opposed to subscriber information) from a US-based cloud provider?

Accepted Answer

A subpoena for subscriber information only; a warrant is required for content data

Answer

An administrative subpoena covers all data types including content

Answer

Only a court order signed by a magistrate judge is needed for any data

Answer

Direct law enforcement portal access is available without separate legal process

Question 5

What mobile forensics technique involves analyzing DNS query logs to reconstruct a user's application and network browsing activity even when HTTPS content is encrypted?

Accepted Answer

DNS forensic analysis of device-cached queries and network logs

Answer

Passive DNS replication from carrier logs

Answer

Network traffic baseline analysis

Answer

Deep packet protocol dissection

Question 6

Which iOS database tracks cellular and Wi-Fi data consumption per application and is useful for establishing patterns of network activity?

Accepted Answer

DataUsage.sqlite in the SystemStats directory

Answer

/var/log/asl/network.log

Answer

/private/var/mobile/Library/Caches/com.apple.networkd/network_usage.db

Answer

NetworkStats.plist in the carrier bundle

Question 7

When performing forensic analysis of mobile VPN usage, what artifact would best reveal the VPN server address, protocol used, and connection timestamps?

Accepted Answer

VPN configuration profiles and app connection logs stored on the device

Answer

Carrier CDR records from the mobile provider

Answer

GPS location data correlated with network transitions

Answer

SMS message content from the VPN provider