GIAC GASF Exam - Topic 1 Question 20 Discussion

Actual exam question for GIAC's GASF exam

Question #: 20
Topic #: 1

[All GASF Questions]

What type of acquisition is being examined in the image below?

AiOS bypass lock

BBlackberry logical

CAndroid physical

DWindows Mobile file system

Show Suggested Answer

Suggested Answer: D

backed up. The file manifest.mbdb contains a list of data stored in the backup. The file status.plist contains details about the backup including a flag to identify the backup type, date and version. The file notes.sqlite is an android file that contains notes written by the user on the device.

by Delmy at Dec 12, 2023, 06:07 PM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nohemi

3 months ago

Wait, is that really how iOS bypass works?

upvoted 0 times

...

Marshall

4 months ago

I thought Blackberry was still a thing?

upvoted 0 times

...

Catarina

4 months ago

Not so sure, could be Android physical too.

upvoted 0 times

...

Darrin

4 months ago

Totally agree, definitely iOS!

upvoted 0 times

...

Kristin

4 months ago

Looks like an iOS bypass lock to me.

upvoted 0 times

...

Marguerita

4 months ago

I’m confused between Android physical and Windows Mobile file system. I wish I had reviewed those distinctions more thoroughly!

upvoted 0 times

...

Wynell

5 months ago

I’m leaning towards Blackberry logical, but I can’t recall the specific details. It’s been a while since we went over that.

upvoted 0 times

...

Mitzie

5 months ago

I remember practicing a question similar to this, but it was about Android. I feel like the image could be misleading.

upvoted 0 times

...

Janna

5 months ago

I think this might be an iOS bypass lock, but I'm not entirely sure. We did cover that in class, right?

upvoted 0 times

...

Sarina

5 months ago

This seems like a straightforward mobile forensics question. Based on the options, I'm leaning towards Android physical acquisition as the correct answer, but I'll double-check the details in the image to be sure.

upvoted 0 times

...

Nidia

5 months ago

I'm feeling a bit lost on this one. Mobile device forensics isn't my strongest area, so I'll need to take my time and really think through the options before making a guess.

upvoted 0 times

...

Magda

5 months ago

Okay, the image shows some kind of mobile device interface, so I'm guessing this is testing our knowledge of different mobile OS acquisition methods. I'll try to remember the key differences between logical, physical, and other types of mobile forensic techniques.

upvoted 0 times

...

Alton

5 months ago

Hmm, I'm not too familiar with mobile device forensics. I'll have to read through the options carefully and see if I can spot any clues in the image that might help me narrow it down.

upvoted 0 times

...

Willard

5 months ago

This looks like a mobile device forensics question. I'll need to carefully examine the image and options to determine the type of acquisition being tested.

upvoted 0 times

...

Xuan

5 months ago

Hmm, I'm a bit unsure about this one. The question mentions a "full backup" and "service-level down time," but I'm not sure which backup technique that corresponds to. I'll have to think this through carefully.

upvoted 0 times

...

Chanel

5 months ago

Hmm, I'm not sure about this one. I'd have to think more about how the different software categories might interact with the Traps agent. Maybe I should review the material on Traps and its potential conflicts.

upvoted 0 times

...

Alethea

10 months ago

iOS bypass lock? Really? This is clearly an Android device, so option A is completely off the mark. C'mon, guys, pay attention to the image!

upvoted 0 times

Shakira

9 months ago

Thanks for pointing that out. Android physical is the correct acquisition type for this image.

upvoted 0 times

...

Jerrod

9 months ago

I agree, option A, iOS bypass lock, doesn't make sense at all. Android physical is the way to go.

upvoted 0 times

...

Maile

9 months ago

You're right, it's definitely an Android device. Option C, Android physical, is the correct choice.

upvoted 0 times

...

Latricia

10 months ago

Haha, I think the correct answer is Windows Mobile file system. I mean, who even uses Windows Mobile anymore? That's got to be the funniest option here.

upvoted 0 times

Lynette

9 months ago

B) Blackberry logical

upvoted 0 times

...

Dallas

9 months ago

Really? I thought it was iOS bypass lock.

upvoted 0 times

...

Dulce

9 months ago

C) Android physical

upvoted 0 times

...

Jade

9 months ago

Haha, I think the correct answer is Windows Mobile file system. I mean, who even uses Windows Mobile anymore? That's got to be the funniest option here.

upvoted 0 times

...

Tamra

9 months ago

D) Windows Mobile file system

upvoted 0 times

...

Matthew

9 months ago

C) Android physical

upvoted 0 times

...

Merissa

9 months ago

B) Blackberry logical

upvoted 0 times

...

Samira

9 months ago

A) iOS bypass lock

upvoted 0 times

...

Ming

11 months ago

I'm pretty sure this is a Blackberry logical acquisition. The device looks like a Blackberry, and the question mentions 'acquisition', so option B must be the right choice.

upvoted 0 times