Question 1

The files pictured below from a BlackBerry OS10 file system have a unique file extension. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/GIAC_GASF/page_10_img_1.jpg What can be concluded about these files?

Accepted Answer

B

Explanation: On BlackBerry OS10, a unique file extension (commonly .rem) indicates that the file is encrypted. This is a core feature of BlackBerry's data-at-rest protection, often applied to files on a media card. The encryption uses a key derived from the device's hardware and the user's password, rendering the file's contents unreadable without proper authentication through the original device. The extension serves as a flag for the operating system to identify the file as encrypted and handle it accordingly. Therefore, the most accurate conclusion is that the files are encrypted to prevent unauthorized viewing.

Question 2

Review the message database below. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/GIAC_GASF/page_28_img_1.jpg What can be determined based on the information provided?

Accepted Answer

B

Explanation: The id column in a database table, such as the one shown, is typically an auto-incrementing primary key. In the provided data, the sequence of id values is interrupted, jumping from 779 to 800. When a record is deleted from a database table that uses an auto-incrementing key, the key value is not reused. Therefore, a gap in the numerical sequence is a strong forensic indicator that records—in this case, messages with IDs 780 through 799—were created and subsequently deleted. The deleted column only reflects the status of existing records, not those that have been permanently removed.

Question 3

Review the two highlighted sections in the hex output below from the file MP0c_000. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/GIAC_GASF/page_28_img_2.jpg Convert the phone number found in raw format extracted from a Chinese knock-off device.

Accepted Answer

B

Question 4

Which iOS backup file will contain the last time the device was backed up?

Accepted Answer

D

Explanation: The Info.plist file, located in the root directory of an unencrypted iOS backup, is a property list file containing key metadata about the backup and the device itself. This file stores numerous key-value pairs, including the device's name, UDID, serial number, iOS version, and, most relevantly, the Last Backup Date. This timestamp explicitly records the date and time the backup process was initiated, making it the direct source for the information requested in the question.

Question 5

As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and
it
appears that no third-party applications were installed on the device. Which other file may provide
you with additional information on applications that were accessed with the handset?

Accepted Answer

C

Explanation: The BlackBerry Event Log (eventlog.dat) is a critical artifact for forensic analysis as it records a wide range of system and application activities. This includes timestamps for when applications were started and stopped, device power cycles, and connections to the BlackBerry Enterprise Server. Even if an application has been uninstalled and does not appear in the installed applications list, its execution history may still be preserved within these logs, providing direct evidence of which applications were accessed on the handset.

Question 6

Which file system is mostly found on Samsung devices?

Accepted Answer

C

Explanation: The Robust File System (RFS) is a proprietary file system developed by Samsung and was predominantly used in their earlier generation of Android smartphones, such as the Samsung Galaxy S and Galaxy S II. It was designed as a flash-friendly file system based on FAT32, incorporating journaling-like features to improve robustness against sudden power loss. While modern Samsung devices have transitioned to standard Android file systems like EXT4 and more recently F2FS (also developed by Samsung), RFS is the file system most historically and uniquely associated with Samsung devices, making it a key area of study in mobile forensics for older models.

Question 7

What does access to iOS DFU mode provide an examiner?

Accepted Answer

D

Explanation: Device Firmware Update (DFU) mode is a low-level diagnostic state on iOS devices that allows the device's firmware to be restored. On older iOS devices with hardware-level bootrom vulnerabilities (e.g., devices with A4 chips like the iPhone 4), DFU mode served as the entry point for forensic exploits. By placing the device in DFU mode, an examiner could use a tool that leverages an exploit (like limera1n) to upload a custom forensic ramdisk. This custom software would then run with elevated privileges, allowing the examiner to bypass the user's passcode and perform a complete physical acquisition of the device's file system. This method is not effective on newer devices (A5 chip and later) due to patched bootroms.

Question 8

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

Accepted Answer

C

Explanation: While modern forensic tools can automatically parse the primary SQLite database for SMS messages (mmssms.db), remnants of messages may exist outside this structured file. These remnants, particularly in unallocated space or memory dumps, can be in the raw Protocol Data Unit (PDU) format. PDU is a complex hexadecimal encoding for SMS data defined by 3GPP standards. Forensic tools may not always identify or correctly decode these raw PDU strings, compelling an examiner to manually search for, extract (carve), and decode them to recover the message content. This manual decoding process is more complex than parsing other database artifacts or automated file carving.

Question 9

What is being shown in the image below? https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/GIAC_GASF/page_16_img_1.jpg

Accepted Answer

A

Explanation: The image displays a call log entry from a mobile device, likely Android. The icon, an arrow pointing away from a phone receiver, specifically denotes an outgoing call. The duration is listed as "0s" (zero seconds), and the entry is colored red. In mobile forensics and user interface design, this combination signifies that an outgoing call was placed but was not answered by the recipient, hence the zero-second duration. The red color is a common visual indicator for calls that did not connect, such as missed incoming calls or, in this case, unanswered outgoing calls.

Question 10

Which cloud based system can be utilized by Android owners to backup user data?

Accepted Answer

D

Explanation: The native, integrated cloud backup system for the Android operating system is provided by Google. This service allows users to back up their data, such as app data, call history, contacts, and device settings, to their personal Google Account. The data is stored within the user's Google Drive cloud storage allocation. This functionality is a core feature of the Android platform, designed to enable seamless data restoration on a new or reset device. While third-party or manufacturer-specific solutions exist, Google's service is the primary cloud-based system available to all Android owners.

Question 11

When examining the iOS device shown below the tool indicates that there are 4 chat messages recovered from the device. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/GIAC_GASF/page_13_img_1.jpg Which of the following locations may contain additional chat information?

Accepted Answer

B

Explanation: iOS applications, especially messaging clients, primarily use SQLite databases to store persistent user-generated data like chat messages, contact details, and timestamps. Forensic tools are programmed to parse known database structures, but they may fail to recover all information. This can happen if the application's database schema has been updated, if messages are deleted (but remain in freelists or write-ahead logs), or if data is fragmented. Therefore, manually examining the databases maintained by the specific application is a critical step to uncover additional chat information that automated tools may have missed.

Question 12

What will happen when a user creates an encrypted backup of their personal iPhone on their work computer then later performs a backup to their personal computer at home?

Accepted Answer

C

Explanation: The setting to encrypt an iPhone backup is stored on the device itself, not on the computer performing the backup. When the user first created an encrypted backup on their work computer, they set a password, and the iPhone was configured to require encryption for all subsequent local backups. When the user later connects the same iPhone to their personal computer, the backup software (Finder on macOS or iTunes on Windows) will recognize this device-level setting and prompt the user to enter the previously established password to proceed with creating the new encrypted backup.

Question 13

Property list (Plist) files are used by iOS devices to store data. Which of the file formats below is common to plist files?

Accepted Answer

D

Explanation: Property List (Plist) files are a fundamental data storage mechanism in iOS and macOS for serializing objects. They can exist in two primary formats: a human-readable XML format and a more compact, efficient binary format. On iOS devices, the binary format is very common, and often the default, because it requires less storage space and can be parsed more quickly by the system. This performance advantage is critical for resource-constrained mobile environments.

Question 14

What is often more of a challenge with mobile forensics than other areas of forensics?

Accepted Answer

D

Explanation: Evidence collection, also known as acquisition, is often the most significant challenge in mobile forensics. Unlike traditional computer forensics where drive imaging is a relatively standardized process, mobile forensics faces immense diversity in hardware, operating systems (e.g., numerous Android and iOS versions), and proprietary data storage. Furthermore, robust security features like full-disk encryption, secure enclaves, and frequent software updates create a constantly evolving landscape. Forensic tools and techniques must continually adapt, and a method that works for one device model or OS version may be completely ineffective on the next, making successful data extraction a primary and persistent hurdle.

Question 15

What is the MAIN difference between a Full Root and a Shell/Soft Root?

Accepted Answer

A

Explanation: The main difference between a Full Root and a Shell/Soft Root is persistence. A Full Root, also known as a permanent root, involves modifying the device's /system partition to install the su binary and a superuser management application. Because these changes are made to a core, persistent partition, the root access survives device reboots. Conversely, a Shell/Soft Root is a temporary method that exploits a vulnerability to gain elevated privileges for the current session only. It does not make permanent modifications to the /system partition, and therefore, root access is lost as soon as the device is restarted.

Free GIAC GASF Actual Exam Questions