18 free GIAC Advanced Smartphone Forensics GASF practice questions from the CertStash pack of 71, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 18 free here, all 71 in the pack, and each step includes the one before it.
Get all 71 questions (US$39) · Download the first 10 as a PDF
Question 1
An Android device user is known to use Facebook to communicate with other parties under examination. There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?
Show answer and explanation
Correct answer: A. com.android.chrome/app_chrome/Default/Local Storage
When Facebook is accessed through a web browser rather than the native application, artifacts are stored in the browser's local storage. Chrome on Android maintains web application data in com.android.chrome/app_chrome/Default/Local Storage, where Facebook web session data, cached content, and communication records would be preserved even without the Facebook app installed.
Why the other options are wrong
- B. dmappmgr.db is a system database unrelated to web browser storage or Facebook artifacts.
- C. /data/system/packages.xml records installed packages and would not show Facebook usage if the app wasn't installed.
- D. AndroidManifest.xml is a configuration file for installed applications and doesn't contain usage artifacts or communication data.
Question 2
Physical Analyzer provides a function to narrow down a search based on a timestamp, a type, a party or date. What is the name of this advanced searching capability?
Show answer and explanation
Correct answer: C. Timeline
Timeline is Physical Analyzer's advanced searching capability that allows examiners to narrow down results based on timestamp, event type, party/contact, and date parameters. It provides a structured temporal view of device artifacts and communications organized chronologically.
Why the other options are wrong
- A. Watchlist Editor is a feature for creating custom keyword lists, not for narrowing searches by timestamp and event type.
- B. Tags are user-assigned labels for marking items, not an advanced search function based on temporal or categorical parameters.
- D. Event of Interest may relate to flagging significant items but is not the specific name for the advanced search filtering capability.
Question 3
Which of the following is a unique 56 bit number assigned to a CDMA handset?
Show answer and explanation
Correct answer: D. Mobile Equipment ID (MEID)
The Mobile Equipment Identifier (MEID) is the 56-bit unique identifier assigned to CDMA handsets. It replaced the older ESN, which is only 32 bits long, because the ESN number space was running out.
Why the other options are wrong
- A. The MSISDN is the subscriber phone number, not a hardware identifier for the handset.
- B. The ESN is a 32-bit identifier, not a 56-bit one.
- C. The IMEI is the identifier used by GSM and UMTS handsets, not the 56-bit CDMA identifier.
Question 4
Which of the following files provides the most accurate reflection of the device’s date/timestamp related to the last device wipe?
Show answer and explanation
Correct answer: A. /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
The AddressBook.sqlitedb file contains database entries with timestamps that reflect when the address book was created or last modified, providing accurate evidence of device initialization state. A complete device wipe resets this database, making it the most reliable indicator of when such an event occurred.
Why the other options are wrong
- B. Safari history.db can be selectively cleared and may not reflect a full device wipe, as Safari data alone doesn't indicate system-level wipe operations.
- C. Viber preference files store application-specific settings that persist independently of system wipes and don't reliably indicate device reset timing.
- D. WhatsApp's pw.dat file is application data that may be retained or backed up independently, not reflecting the actual device wipe timestamp.
Question 5
Which of the following is the term for the SMS malware that sends text messages to a premium number generating large service bills for the user of the targeted device?
Show answer and explanation
Correct answer: A. Trojan
Malware that sends SMS messages to premium-rate numbers, generating unauthorized charges for the device user, is classified as a Trojan. Trojans are deceptive programs that perform malicious actions beyond what the user expects, and SMS premium-rate schemes are a common Trojan behavior on mobile devices.
Why the other options are wrong
- B. Adware displays unwanted advertisements but does not typically generate service charges through premium SMS schemes.
- C. Potentially unwanted applications is a broad category for borderline software, not the specific term for SMS premium-charging malware.
- D. Click bait refers to deceptive web content designed to attract clicks, not malicious software sending premium SMS messages.
Question 6
Which of the following files contains details regarding the encryption state of an iTunes backup file?
Show answer and explanation
Correct answer: C. Manifest.plist
Manifest.plist is the file that contains metadata about an iTunes backup, including encryption state information. This file stores key details about the backup structure and protection settings applied to the backup data.
Why the other options are wrong
- A. Keychain-backup.plist stores encrypted keychain items but not the encryption state of the overall backup.
- B. Manifest.mbdb is a binary database file containing file metadata but not encryption state details.
- D. Status.plist is not a standard file used to track iTunes backup encryption state.
Question 7
In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?
Show answer and explanation
Correct answer: C. BlackBerry Link ID/password
BlackBerry Link ID and password are required in addition to the device passcode to decrypt BlackBerry OS 10 handsets. BlackBerry Link is the synchronization and management service that holds encryption keys and authentication credentials necessary for full device decryption.
Why the other options are wrong
- A. BlackBerry Blend is a remote access service but not the primary authentication required for device decryption.
- B. BlackBerry Balance manages work and personal separation but is not essential for OS-level device decryption.
- D. BBM PIN is for messaging service authentication, not device encryption decryption.
Question 8
As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on applications that were accessed with the handset?
Show answer and explanation
Correct answer: C. Event logs
Event logs on legacy BlackBerry devices contain records of application access and usage even if third-party applications are no longer installed. These logs maintain historical data about application launches and interactions that can reveal which applications were previously used on the device.
Why the other options are wrong
- A. BlackBerry NV Items store configuration data but not detailed application access history.
- B. Content Store holds multimedia and application data but not access event records.
- D. BBThumbs.dat contains thumbnail cache for images but does not track application access events.
Question 9
Which artifact must be carved out manually when examining a file system acquisition of an Android device?
Show answer and explanation
Correct answer: C. SMS messages
SMS messages must be carved out manually when examining an Android file system acquisition because they are often stored in unallocated space or fragmented across the file system. Unlike structured database entries for contacts or system artifacts, deleted SMS messages require data carving techniques to recover.
Why the other options are wrong
- A. Deleted images can typically be recovered through standard file recovery methods from unallocated clusters.
- B. Contacts are usually stored in structured SQLite databases that can be extracted through standard means.
- D. Phone numbers are typically found in structured contact databases or call logs rather than requiring manual carving.
Question 10
When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?
Show answer and explanation
Correct answer: D. FAT
FAT (File Allocation Table) is the most common file system format found on media cards associated with mobile devices. Its simplicity, broad compatibility, and universal support across different devices and operating systems made it the standard for SD cards and microSD cards used in mobile forensics.
Why the other options are wrong
- A. HFS is primarily used on macOS systems, not mobile device media cards.
- B. NTFS is a Windows file system rarely used on mobile device storage media.
- C. Yaffs2 is used for NAND flash storage on some devices but is not the most common format for associated media cards.
What people say about the full Advanced Smartphone Forensics GASF pack 4.4 from 5
I used the GASF exam file for my exam revision and everything turned out well. I passed the exam with 98% grades! Thank you for all the supports!
Thanks very much for your GASF practice questions, with your help Ionly use 3 weeks to take the GASF exam.
Question 11
Which of the following chipsets is commonly found in knock-off handsets?
Show answer and explanation
Correct answer: B. MediaTek (MTK)
MediaTek (MTK) chipsets are commonly found in counterfeit and knock-off handsets due to their low cost and widespread availability. These budget-friendly processors are frequently used in fake or unauthorized devices. Nvidia Tegra is used in premium tablets, the A8 is Apple's proprietary high-end chip, and Qualcomm Snapdragon powers legitimate mainstream devices, making them unsuitable choices for low-cost counterfeit productions.
Why the other options are wrong
- A. Nvidia Tegra is used in premium tablets and devices, not in budget knock-off handsets.
- C. Apple's A8 chip is proprietary and used only in legitimate Apple devices.
- D. Qualcomm Snapdragon powers legitimate mainstream Android devices, not counterfeit phones.
Question 12
Which file will indicate if Siri was active on an iOS device?
Show answer and explanation
Correct answer: D. private/var/Library/Preferences/com.apple.SiriViewService.plist
The file com.apple.SiriViewService.plist in the Preferences directory contains configuration and activity logs related to Siri's operation on iOS devices. This plist file specifically tracks Siri service initialization and usage. The other files relate to reminders, suggestions, and speech selection features but not Siri activity specifically.
Why the other options are wrong
- A. The SpeechSelection plist relates to accessibility features, not Siri activity.
- B. The reminders pushstore file tracks push notifications for the Reminders app, not Siri usage.
- C. The suggestions plist file relates to system suggestions functionality, not Siri operations.
Question 13
Where can an analyst find data to provide additional artifacts to support the evidence in the highlighted file?
Show answer and explanation
Correct answer: B. browser2.db
The highlighted file is browser2.db-wal, which is a write-ahead log file associated with the browser2.db database. WAL files are temporary journals that record database transactions before they're committed to the main database file. To obtain complete artifact data and additional evidence supporting what's in the WAL file, an analyst must examine the corresponding main database file, browser2.db, which contains the committed browser history, cookies, cache, and other browsing artifacts that correlate with the transaction data in the WAL file.
Why the other options are wrong
- A. internal.db-wal is another WAL file from a different application (media providers), not related to the browser data in the highlighted file.
- C. sysmon2.db-shm is a shared memory file for the sysmon database, which contains system monitoring data unrelated to browser artifacts.
- D. external.db is a separate database file for media providers, not the primary browser database needed to correlate with browser2.db-wal data.
Question 14
Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?
Show answer and explanation
Correct answer: B. Signature-based detection
Signature-based detection identifies malware by comparing file hash values against a known database of malicious file signatures. When Cellebrite Physical Analyzer uses Bit Defender to flag files with known bad hash values, it is performing signature-based detection by matching against established malware signatures.
Why the other options are wrong
- A. Specific-based detection is not a standard malware classification term.
- C. Behavioral-based detection analyzes program actions and behaviors rather than static hash matching.
- D. Cloud-based malware detection would require real-time server queries rather than local hash comparison.
Question 15
Which of the following is one potential risk of using the ALWAYS OFF rule for handling cell phones?
Show answer and explanation
Correct answer: B. Engaging password or PIN protection mechanism
The ALWAYS OFF rule for cell phones aims to prevent automatic data modifications. However, a potential risk is that turning off the device may trigger password or PIN protection mechanisms upon restart, which can lock the examiner out of accessing the device and its data. This protective mechanism activates when the device powers on without the correct credentials.
Why the other options are wrong
- A. Keeping the device off prevents background processes that would overwrite data; this is the intended benefit of the rule.
- C. Turning off the device preserves call logs and cell tower information already stored; it does not cause their destruction.
- D. Improper handling by the user is a general concern not specific to the ALWAYS OFF rule's inherent risks.
Question 16
In 2015, Apples iTunes store was found to be hosting several malicious applications that were infected as a result of hacked version of the developer toolkit used to create applications. Which Apple developer suite was targeted?
Show answer and explanation
Correct answer: A. Xcode
Xcode, Apple's integrated development environment, was the targeted developer suite in the 2015 attack. Attackers compromised versions of Xcode downloaded from unofficial sources, allowing them to inject malicious code into applications built with the toolkit, resulting in infected apps appearing in the iTunes App Store.
Why the other options are wrong
- B. ADB is the Android Debug Bridge used for Android development, not an Apple development tool.
- C. Momentics IDE is used for BlackBerry development, not Apple application creation.
- D. Xamarin is a cross-platform development tool not specific to Apple's official developer suite.
Question 17
What type of storage does an iOS device use for user data?
Show answer and explanation
Correct answer: C. NAND
iOS devices use NAND flash memory for storing all user data, applications, and the operating system. NAND is a type of non-volatile flash memory that provides the persistent storage required for mobile devices. SSD refers to larger computers, SIM cards store only carrier information, and NOR flash is primarily used for bootloaders and firmware in iOS devices, not user data storage.
Why the other options are wrong
- A. SSDs are used in computers and laptops, not in iOS mobile devices.
- B. SIM cards store only cellular carrier credentials and contacts, not general user data.
- D. NOR flash is used for boot code and firmware in iOS, while user data is stored in NAND flash.
Question 18
Which of the following can most forensics tools crack on an iOS device?
Show answer and explanation
Correct answer: B. Simple passcode
Forensics tools can crack simple numeric passcodes through brute-force attacks because they have limited complexity (typically 4-6 digits). Touch ID uses biometric data that cannot be replicated by forensic tools, and passphrases with sufficient length and complexity resist brute-force cracking due to the exponentially larger keyspace required.
Why the other options are wrong
- A. Biometric authentication cannot be cracked by forensic tools as fingerprint data cannot be replicated.
- C. Strong passphrases have sufficient entropy to resist brute-force attacks used by forensic tools.
That was 18 of 71.
The full GIAC Advanced Smartphone Forensics GASF pack has all 71 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 35 free as one PDF by email. Get the Half Pack →