GIAC GASF Exam Questions Instant Access - No Installation Required

Question 1

What type of acquisition is being examined in the image below?

AiOS bypass lock

BBlackberry logical

CAndroid physical

DWindows Mobile file system

Answer : C

Question 2

Review the message database below.

What can be determined based on the information provided?

AThere are no deleted messages in this database

BThe interrupted sequence in the id column could indicate deleted messages

CThe messages in this table are ''outgoing''

DThe messages contain attachments

EThe messages in this table are only ''incoming''

Answer : B

Question 3

Cellebrite's Physical Analyzer will conduct a Quick Scan for images, which goes through and carves files that may have been deleted from the device. When carving for image files, which of the following methods is most effectively used to recover data?

AUpdate the signature database

BCarve based on file header

CCarve based on file metadata

DCarve based on memory ranges

Answer : B

Question 4

An analyst investigating a Nokia S60 Symbian device wants to know if an Adobe Flash file on the handset is compromised.

Which file in the image will best target the Adobe Flash files?

AFLASHLITE .sis

Bflashliteplugin.r03

Csaflash.r01

DOnlinePrint.sis

Answer : A

A sis.file is the package that Symbian uses to install applications on their OS compatible handsets. Knowing that you are investigating an application that is installed on the handset, first narrowing the files down to installer packages, or *.sis files, is a good starting point. Flash is an Adobe product making the most logical of the two remaining* .sis files for review, the FLASHLITE installer package. There are several other files related to ''Flash'' but as resource files, they provide supporting documentation and will not contain the .app file or code that was possibly malicious.

Question 5

Which file will indicate if Siri was active on an iOS device?

Aprivate/var/Library/Preferences/com.apple.suggestions.plist

Bprivate/var/Library/SpringBoard/PushStore/com.apple.reminders.pushstore

Cprivate/var/Library/Preferences/com.apple.SpeakSelection.plist

Dprivate/var/Library/Preferences/com.apple.SiriViewService.plist

Answer : B

active, this status will be reflected in the plist file as ''StatusActive.'' Siri stores information in the common files related to each task (calendar.sqlitedb, call_history.db, etc.)

Question 6

Review the sample database.

What is the BLOB column storing for this particular database table?

AMp4 videos

BEncrypted text messages

CAudio files

DText messages

EJPEG images

Answer : E

BLOBs are used when the data is not easily defined or not typical, so BLOBs can basically be used to store anything. The embedded JPG file most likely stores the image associated with the contact for this application.

The file header of FF D8 indicates a JPEG image is being stored in this BLOB.

Question 7

What information can be concluded by examining this XML file extracted from an Android device?

ASkype was installed but not utilized on the device

BA Skype account was configured and accessed on this device

CSkype was launched but a profile was not created

DA user logged into Skype with a temporary guest profile

Answer : B

GIAC Advanced Smartphone Forensics GASF Exam Questions