GASF — GIAC Advanced Smartphone Forensics Investigator Practice Questions

A phone was seized, and the investigator needs to determine the last accessed app. What tool should be used?

• AA. Elcomsoft Phone Breaker
• BB. XRY
• CC. Oxygen Forensic Suite
• DD. Cellebrite UFED

An investigator is trying to recover deleted text messages from a smartphone. Which method is most effective?

• AA. Check cloud backups
• BB. Use a forensic data recovery utility
• CC. Connect to a computer via USB
• DD. Perform a factory reset

After imaging a smartphone, the investigator needs to analyze app data. Which file type is most commonly associated with app data?

• AA. .exe
• BB. .apk
• CC. .docx
• DD. .zip

An investigator must present recovery findings in court. What must be ensured before this?

• AA. User agreements
• BB. Chain of custody
• CC. Software updates
• DD. Device warranty

An investigator discovers an unfamiliar app on a suspect's phone. What is the first step in assessing its legitimacy?

• AA. Check reviews online
• BB. Perform a social media search
• CC. Uninstall the app
• DD. Analyze associated data