GASF App Data and Artifact Analysis

Question 1

Which format do most messaging and social media apps use to store local data on mobile devices?

Accepted Answer

SQLite databases

Answer

The vast majority of mobile apps use SQLite databases for local structured data storage due to its lightweight, embedded nature and wide platform support.

Question 2

What tool is commonly used to examine SQLite databases recovered from mobile devices?

Accepted Answer

DB Browser for SQLite

Answer

DB Browser for SQLite (SQLiteDBBrowser) is a widely used GUI tool for opening, browsing, and querying SQLite database files recovered during mobile forensics.

Question 3

Where does WhatsApp typically store its message database on Android?

Accepted Answer

/data/data/com.whatsapp/databases/msgstore.db

Answer

WhatsApp stores its primary message database in msgstore.db within the app's private data directory under /data/data/com.whatsapp/databases/.

Question 4

What encryption does WhatsApp use for its local msgstore.db on Android, and how can it be decrypted forensically?

Accepted Answer

WhatsApp-proprietary crypt12/crypt14/crypt15 encryption; decrypted using the key file stored at /data/data/com.whatsapp/files/key

Answer

WhatsApp encrypts its database using its proprietary crypt formats, and the decryption key is stored in a 'key' file in the app's private files directory, requiring root access to retrieve.

Question 5

Which artifact would reveal which apps were recently active in the foreground on an iOS device?

Accepted Answer

knowledgeC.db ZOBJECT table

Answer

The knowledgeC.db database's ZOBJECT table records app foreground/background transitions with timestamps, providing a detailed activity timeline.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF App Data and Artifact Analysis