GASF iOS Forensics Techniques

Question 1

Which iOS file system is used on devices running iOS 10.3 and later?

Accepted Answer

APFS

Answer

Apple introduced APFS (Apple File System) as the default file system for iOS devices starting with iOS 10.3.

Question 2

What is the primary purpose of the iOS Keychain in forensic investigations?

Accepted Answer

Storing encrypted credentials and tokens

Answer

The iOS Keychain stores sensitive data such as passwords, encryption keys, and authentication tokens in an encrypted container.

Question 3

Which directory on iOS contains the majority of third-party application data?

Accepted Answer

/var/mobile/Containers/Data/Application/

Answer

Third-party app sandboxed data is stored under /var/mobile/Containers/Data/Application/ on iOS devices.

Question 4

What type of acquisition bypasses iOS security controls by exploiting vulnerabilities to gain raw disk access?

Accepted Answer

Chip-off acquisition

Answer

Chip-off acquisition involves physically removing the NAND flash chip to read raw data, bypassing all OS-level security.

Question 5

Which iOS backup file contains the device's backup encryption key wrapped by the backup password?

Accepted Answer

Manifest.plist

Answer

Manifest.plist in an iTunes backup contains the IsEncrypted flag and metadata needed to decrypt encrypted backups.

GASF - Giac Advanced Smartphone Forensics Practice Test