GIAC Advanced Smartphone Forensics (GASF) Certification Questions

1. Based on the image below, which file system is being examined?

2. What type of acquisition is being examined in the image below?

3. Which of the following files contains details regarding the encryption state of an iTunes backup file?

4. In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

5. The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

6. An analyst investigating a Nokia S60 Symbian device wants to know if an Adobe Flash file on the handset is compromised.

Which file in the image will best target the Adobe Flash files?

7. As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device.

Which other file may provide you with additional information on applications that were accessed with the handset?

8. Which artifact must be carved out manually when examining a file system acquisition of an Android device?

9. When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

10. Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values.

This is an example of which type of mobile malware detection?