GIAC Advanced Smartphone Forensics (GASF)

Review the information contained within the Viber application running on an Android device.

Which of the following can be determined?

Which iOS backup file will contain the last time the device was backed up?

You have conducted a keyword search over flash.bin and notice that multiple instances of the same data appear many times throughout the flash image.

What is this an example of?

An analyst is investigating files on a Nokia S60 Symbian device and looking for data that would contain possible cell tower locations, date and time stamps, phone numbers and/or references to files saved on the device.

Which of the follow files would contain user data that was created and stored on the device that meet this criteria?

Using an emulator and running an application through a series of processes to figure out how it would behave on an actual device is called:

Which file type below is commonly associated with locational data and is an export option from within Cellebrite Physical Analyzer and XRY to provide detailed visual output of geographic information?

Which file system is mostly found on Samsung devices?

Which artifact(s) can be extracted from a logical image only if the device the image was acquired from was jailbroken?

Which file, located on the Android file system, may be examined to correlate files related to external SD cards that were once used in an Android device?

Examine the unpacked Android application below.

Which important file, resident in most Android applications, is missing?