10 free GIAC Advanced Smartphone Forensics GASF practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 71 questions. Work through them, then open each answer to check your reasoning.
Get all 71 questions (US$39) · Download these 10 as a PDF
Question 1
Based on the image below, which file system is being examined?
Show answer and explanation
Correct answer: C. Android
The file system structure shown contains characteristic Android directories and files including NVRAM, NVD_DATA, @WAP, @BPP, @FTP, @USER, @WCACHE, and @BT folders, along with files like DEVDB. The presence of MMS, Photos, Download, and Ebook folders organized in this hierarchical manner is typical of Android file systems. The naming conventions (using @ prefixes for system directories) and the overall structure match Android's internal storage organization rather than other mobile operating systems.
Why the other options are wrong
- A. Chinese knock-off phones would typically use modified versions of Android or Windows rather than a distinct proprietary file system with these specific directory structures.
- B. Windows file systems use different directory structures like Windows, System32, Program Files, and Users; the directory names shown are not characteristic of Windows.
- D. BlackBerry devices used proprietary file systems with different organization patterns and would not show this mix of Android-specific directories like NVRAM and @WAP.
Question 2
What type of acquisition is being examined in the image below?
Show answer and explanation
Correct answer: C. Android physical
The GIAC TEST – Autopsy 3.1.3 interface shown displays a physical acquisition of a mobile device's file system. The evidence includes multiple volumes (vol1-vol13) with various partitions including BOOT, BOTAO, BOOTA1, EFS, PARAM, RECOVERY, RADIO, CACHE, SYSTEM, and HIDDEN – a characteristic partition structure of Android devices. The volumes show starting sectors and length measurements in sectors, indicating raw physical disk imaging rather than logical extraction or file-level acquisition. The presence of Android-specific partitions like RECOVERY, RADIO, and CACHE, combined with the sector-level analysis shown in Autopsy, confirms this is a physical acquisition of an Android device's file system.
Why the other options are wrong
- A. iOS bypass lock examinations involve different tools and would not show Androi-pecific partitions like RADIO, RECOVERY, and CACHE.
- B. Blackberry logical acquisitions extract logical files and data at a higher level, not raw sector-level partitions with boot sectors and system partitions as shown here.
- D. Windows Mobile file system acquisitions would display Windows Mobile-specific partitions and file structures, not the Android partition scheme visible in this image.
Question 3
Which of the following files contains details regarding the encryption state of an iTunes backup file?
Show answer and explanation
Correct answer: C. Manifest.plist
The Manifest.plist file contains metadata about an iTunes backup, including encryption state information. This file is a property list that stores backup configuration details and encryption status flags that indicate whether the backup is encrypted or not.
Why the other options are wrong
- A. Keychain-backup.plist stores encrypted keychain data but does not contain overall backup encryption state metadata.
- B. Manifest.mbdb is a binary database file containing file metadata and checksums but not encryption state information.
- D. Status.plist is not a standard iTunes backup file that tracks encryption state.
Question 4
In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?
Show answer and explanation
Correct answer: C. BlackBerry Link ID/password
BlackBerry Link ID and password are required in addition to the device passcode to decrypt BlackBerry OS 10 handsets. BlackBerry Link was the synchronization and management service that worked in conjunction with device-level encryption, making credentials necessary for full decryption and access.
Why the other options are wrong
- A. BlackBerry Blend is a remote access feature but its credentials are not essential for decrypting the device itself.
- B. BlackBerry Balance is a workspace partitioning feature and does not provide decryption credentials for the device.
- D. BBM pin is used for messaging service authentication but is not required for device decryption.
Question 5
The device pictured below is in Download Mode to attempt a physical acquisition.
What can be ascertained by viewing the Android boot screen below?
Show answer and explanation
Correct answer: C. The Original/Factory ROM is booting
The Android boot screen displays the standard Google Android mascot and the 'Downloading…' message with 'Do not turn off target!!' warning, which indicates the device is in Download Mode (also called Fastboot or Odin mode on Samsung devices). This is the factory/original bootloader interface that appears when a device boots into recovery or download mode using the original firmware. The presence of this unmodified factory boot interface specifically indicates that the original/factory ROM is booting, as custom ROMs or modified systems would display different boot screens or logos.
Why the other options are wrong
- A. Rooting status cannot be determined from the bootloader screen alone; rooted devices still display the standard factory boot interface.
- B. ROM modifications cannot be ruled out simply because the factory boot screen is displayed; changes to the ROM do not necessarily alter the bootloader screen appearance.
- D. There is no evidence from this screen that the original ROM was modified; the appearance of the original factory bootloader indicates the current state is the factory ROM, not a history of modifications.
Question 6
An analyst investigating a Nokia S60 Symbian device wants to know if an Adobe Flash file on the handset is compromised.
Which file in the image will best target the Adobe Flash files?
Show answer and explanation
Correct answer: C. saflash.r01
The file saflash.r01 is the best target for investigating Adobe Flash files on a Nokia S60 Symbian device. The 'saflash' designation refers to the Symbian Adobe Flash plugin/library component, and .r01 indicates it is a resource or archive file (part 1 of a multi-part set). This file represents the core Adobe Flash runtime engine on the device. While FLASHLITE.sis is Flash-related, it is an installation package rather than the actual Flash plugin executable that would be used during runtime. Targeting saflash.r01 provides direct access to the Flash implementation where malicious code would be executed.
Why the other options are wrong
- A. FLASHLITE.sis is an installer package, not the active Flash plugin file; examining the extracted or installed saflash component is more direct for compromise detection.
- B. flashliteplugin.r03 is a resource file but appears to be a later component or resource archive rather than the primary Flash engine that would be most critical to analyze.
- D. OnlinePrint.sis is an unrelated installation package for print functionality and has no connection to Adobe Flash files.
Question 7
As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device.
Which other file may provide you with additional information on applications that were accessed with the handset?
Show answer and explanation
Correct answer: C. Event logs
Event logs on BlackBerry devices contain records of application execution and access, providing evidence of which applications were used even if they are no longer present in the installed applications list. These logs preserve historical data about application interactions.
Why the other options are wrong
- A. BlackBerry NV Items store persistent device settings but do not track application access history.
- B. Content Store holds application data but does not provide information about accessed applications when they're uninstalled.
- D. BBThumbs.dat is a cache file for image thumbnails and does not track application access information.
Question 8
Which artifact must be carved out manually when examining a file system acquisition of an Android device?
Show answer and explanation
Correct answer: C. SMS messages
SMS messages must be carved out manually when examining Android file system acquisitions because they are typically stored in SQLite databases that require specialized recovery techniques. Unlike contacts and other structured data that may be recoverable through database parsing, deleted SMS messages often require binary carving to reconstruct.
Why the other options are wrong
- A. Deleted images are typically found and recovered through standard carving tools looking for file signatures in unallocated space.
- B. Contacts are usually stored in accessible database files that can be parsed without requiring manual carving.
- D. Phone numbers are typically extracted from contact records or call logs that can be accessed through database analysis.
Question 9
When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?
Show answer and explanation
Correct answer: D. FAT
FAT (File Allocation Table) is the most common file system format found on media cards used with mobile devices. Legacy and current SD cards, microSD cards, and similar removable storage typically use FAT32 or exFAT variants due to broad compatibility and standards support.
Why the other options are wrong
- A. HFS is Apple's file system used on macOS and iOS devices, not typically on removable media cards.
- B. NTFS is primarily a Windows file system and is rarely used on mobile device media cards due to compatibility limitations.
- C. Yaffs2 is used for NAND flash storage in some Android devices but is not the standard format for removable media cards.
Question 10
Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?
Show answer and explanation
Correct answer: B. Signature-based detection
Signature-based detection identifies malware by comparing file hash values against a database of known malicious files. Cellebrite's use of Bit Defender to flag files with known bad hashes is a classic implementation of signature-based detection, where previously identified malware is matched against new samples.
Why the other options are wrong
- A. Specific-based detection is not a standard malware detection terminology in this context.
- C. Behavioral-based detection analyzes program actions and activities rather than matching against hash values of known malware.
- D. Cloud-based malware detection would involve sending files to remote servers for analysis rather than checking against local hash databases.
That was 10 of 71.
The full GIAC Advanced Smartphone Forensics GASF pack has all 71 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.