2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

GIAC Advanced Smartphone Forensics GASF Exam Practice Questions, practice question pack
GIAC · Advanced Smartphone Forensics GASF

GIAC Advanced Smartphone Forensics GASF Exam Practice Questions

99% pass rateUpdated 1 Nov 202671 questions2 PDFs by email
4.45 reviews
(5 customer reviews)

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Your PDF is prepared and emailed to you after checkout, usually within a few hours.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
I used the GASF exam file for my exam revision and everything turned out well. I passed the exam with 98% grades! Thank you for all the supports!
AugusAdvanced Smartphone Forensics GASF
Category:
TRY BEFORE YOU BUY

Three of the 71 questions in this pack

Question 1

An Android device user is known to use Facebook to communicate with other parties under examination. There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?

  1. com.android.chrome/app_chrome/Default/Local Storage
  2. dmappmgr.db
  3. /data/system/packages.xml
  4. AndroidManifest.xml
Show answer and explanation

Correct answer: A. com.android.chrome/app_chrome/Default/Local Storage

When Facebook is accessed through a web browser rather than the native application, artifacts are stored in the browser's local storage. Chrome on Android maintains web application data in com.android.chrome/app_chrome/Default/Local Storage, where Facebook web session data, cached content, and communication records would be preserved even without the Facebook app installed.

Why the other options are wrong

  • B. dmappmgr.db is a system database unrelated to web browser storage or Facebook artifacts.
  • C. /data/system/packages.xml records installed packages and would not show Facebook usage if the app wasn't installed.
  • D. AndroidManifest.xml is a configuration file for installed applications and doesn't contain usage artifacts or communication data.

Question 2

Physical Analyzer provides a function to narrow down a search based on a timestamp, a type, a party or date. What is the name of this advanced searching capability?

  1. Watchlist Editor
  2. Tags
  3. Timeline
  4. Event of Interest
Show answer and explanation

Correct answer: C. Timeline

Timeline is Physical Analyzer's advanced searching capability that allows examiners to narrow down results based on timestamp, event type, party/contact, and date parameters. It provides a structured temporal view of device artifacts and communications organized chronologically.

Why the other options are wrong

  • A. Watchlist Editor is a feature for creating custom keyword lists, not for narrowing searches by timestamp and event type.
  • B. Tags are user-assigned labels for marking items, not an advanced search function based on temporal or categorical parameters.
  • D. Event of Interest may relate to flagging significant items but is not the specific name for the advanced search filtering capability.

Question 3

Which of the following is a unique 56 bit number assigned to a CDMA handset?

  1. Mobile Station International Subscriber Directory Number (MSISDN)
  2. Electronic Serial Number (ESN)
  3. International Mobile Equipment Identifier (IMEI)
  4. Mobile Equipment ID (MEID)
Show answer and explanation

Correct answer: D. Mobile Equipment ID (MEID)

The Mobile Equipment Identifier (MEID) is the 56-bit unique identifier assigned to CDMA handsets. It replaced the older ESN, which is only 32 bits long, because the ESN number space was running out.

Why the other options are wrong

  • A. The MSISDN is the subscriber phone number, not a hardware identifier for the handset.
  • B. The ESN is a 32-bit identifier, not a 56-bit one.
  • C. The IMEI is the identifier used by GSM and UMTS handsets, not the 56-bit CDMA identifier.

See all 18 free questions Get the full pack, US$39

REVIEWS

5 reviews for GIAC Advanced Smartphone Forensics GASF Exam Practice Questions

  1. King –

    Undoubtedly, these GASF exam questions are perfect for all aspiring candidates! I passed the exam together with my two friends. So excited and we are going to have a celebration!

  2. Augus –

    I used the GASF exam file for my exam revision and everything turned out well. I passed the exam with 98% grades! Thank you for all the supports!

  3. Venus –

    I discovered these GASF practice test a few days to my exam and I must confess that I found them in time. I got almost all GASF exam questions from the test and passed the exam. You can just rely on them.

  4. Meroy –

    Thanks very much for your GASF practice questions, with your help Ionly use 3 weeks to take the GASF exam.

  5. Penelope –

    Using this I got hired at a great tech company of the city. Thanks a lot for high quality GASF dump.

Only logged in customers who have purchased this product may leave a review.

How much of the GIAC Advanced Smartphone Forensics GASF bank is free?

71 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 1825% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 35the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 71100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the GIAC Advanced Smartphone Forensics GASF pack

  • 71 questions mapped to the GASF exam certification objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Delivered by email shortly after checkout
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A GASF attempt costs US$999 (US$899 for a retake). This pack is US$39, paid once.

What makes the GASF hard

GASF is the GIAC certification paired with the SANS FOR585 smartphone forensics course, and like every GIAC exam it is open book: hardcopy books and personal notes are allowed, the internet and electronic files are not. That changes how candidates prepare.

The exam is 75 questions in two hours with a 69% pass mark, which leaves about 96 seconds a question, so a good index into notes matters more than memorising, and the questions are written so that looking everything up will run out the clock.

The objectives follow a phone from acquisition to analysis: mobile forensics fundamentals and acquisition methods, Android and iOS file system and artefact analysis, third-party application analysis, malware and spyware detection, and event and location artefact analysis. Questions frequently show a table, hex or a database row and ask what it means, so recognising artefact structures on sight is what passes this exam.

About the exam

GASF (GIAC Advanced Smartphone Forensics) validates forensic examination of mobile phones and tablets: mobile forensics fundamentals, Android and iOS file system and artefact analysis, application analysis, malware and spyware detection, and event artefact analysis. There are no prerequisites; it is aligned to SANS FOR585.

Questions before you buy

How quickly do I receive it?

Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products