GIAC >> GASF

Which iOS backup file will contain the last time the device was backed up?

by

Which iOS backup file will contain the last time the device was backed up? The file info.plist contains many artifacts regarding the device, including the last time it was backed up. The file manifest.mbdb contains a list of data stored in the backup. The file status.plist contains details about the backup including a flag to … Read more

When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

by

When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format? Question: When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format? Options: HFS NTFS Yaffs2 FAT Correct Answer The Correct Answer for this … Read more

Where are iOS Class keys stored?

by

Where are iOS Class keys stored?Reference: https://www.apple.com/business/docs/iOS_Security_Guide.pdf Question: Where are iOS Class keys stored? Options: In iCloud Within the metadata of each file Between the flash memory and the system area on the device In effacable storage Correct Answer The Correct Answer for this Question is Within the metadata of each file

How it would behave on an actual device is called:

by

Using an emulator and running an application through a series of processes to figure out how it would behave on an actual device is called:Reference: https://pdfs.semanticscholar.org/90d9/6a3ab48a1b1039573d8a9bfd11e1ab957b82.pdf Question: How it would behave on an actual device is called: Options: Forensic analysis Dynamic analysis Web analysis Static analysis Correct Answer The Correct Answer for this Question is … Read more

When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes even when the device is simply powered on. It is best practice to:

by

When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes even when the device is simply powered on. It is best practice to: Mobile devices are constantly changing when powered on, and there is no way to write block a mobile device because they communicate using modern protocols … Read more

What is the MAIN difference between a Full Root and a Shell/Soft Root?

by

What is the MAIN difference between a Full Root and a Shell/Soft Root? Question: What is the MAIN difference between a Full Root and a Shell/Soft Root? Options: Full root is permanent Full root Leaves traces behind on the device Soft root Allows system level access without a password Soft root Utilizes Shell root Correct … Read more

Which of the following devices below runs the Apple iOS operating system?

by

Which of the following devices below runs the Apple iOS operating system? iOS devices can be defined as Apple products running the Apple iPhone operating system including the iPhone, iPad and iPod Touch. The Apple watch runs Watch OS, which is similar to iOS. MacBook Pros run Mac OSX and the Apple TV is using … Read more

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

by

Which artifact must be carved out manually when examining a file system acquisition of an Android device? Question: Which artifact must be carved out manually when examining a file system acquisition of an Android device? Options: Deleted images Contacts SMS messages Phone numbers Correct Answer The Correct Answer for this Question is SMS messages

How would an examiner review items deleted from a SQLITE database?

by

How would an examiner review items deleted from a SQLITE database? Question: How would an examiner review items deleted from a SQLITE database? Options: Using a Hex Viewer Converting the database to a txt file Reviewing the file header Selecting the raw data from the table Correct Answer The Correct Answer for this Question is … Read more

Which file, found natively on most Android devices, will contain location history such as coordinates, physical addresses and timestamps?

by

Which file, found natively on most Android devices, will contain location history such as coordinates, physical addresses and timestamps?Reference: https://books.google.com.pk/books?id=zDibrpXTfxMC&pg=PA356&lpg=PA356&dq=data/data/com.google.android.apps.maps/databases/ da_destination_history&source=bl&ots=-KA8ikP4r& sig=IM_QC11zGF73P3zi8Ds9LQb2eW8&hl=en&sa=X&ved=0ahUKEwjcrObe4J7aAhXENJoKHdSLCP0Q6AEILzAB#v=onepage&q=data%2Fdata%2Fcom.google.android.apps.maps%2Fdatabases%2Fda_destination_history&f=false Question: Which file, found natively on most Android devices, will contain location history such as coordinates, physical addresses and timestamps? Options: /data/data/com.google.android.apps.maps/databases/da_destination_history /data/data/com.google.android.apps.maps/databases/search_history.db /data/data/com.google.android.location/files/DATA_Preferences /data/data/com.vznavigator.ADR6300/databases/NIMSTORE.db Correct Answer The Correct Answer for this Question … Read more