GIAC Exam GASF Topic 2 Question 48 Discussion

Actual exam question for GIAC's GASF exam

Question #: 48
Topic #: 2

[All GASF Questions]

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

ADeleted images

BContacts

CSMS messages

DPhone numbers

Show Suggested Answer

Suggested Answer: C

by Karl at Jan 23, 2025, 01:30 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Anissa

1 months ago

Wait, we're supposed to carve something out manually? I thought this was the 21st century. Can't we just use some magic forensics software?

upvoted 0 times

...

Destiny

1 months ago

A) Deleted images? Really? That's like asking me to find a needle in a haystack. I'm pretty sure the answer is C) SMS messages.

upvoted 0 times

Roosevelt

8 days ago

No, I'm pretty confident it's C) SMS messages.

upvoted 0 times

...

Stephaine

10 days ago

Are you sure? I thought it might be B) Contacts.

upvoted 0 times

...

Paola

15 days ago

I think the answer is C) SMS messages.

upvoted 0 times

...

Tess

2 months ago

Hmm, I'm gonna go with B) Contacts. Can't have a proper Android forensics without digging through someone's contact list, right?

upvoted 0 times

Edgar

13 days ago

True, but don't forget about A) Deleted images, they can contain valuable information too.

upvoted 0 times

...

Thersa

14 days ago

Actually, C) SMS messages are also important to manually carve out.

upvoted 0 times

...

Albina

1 months ago

I think you're right, B) Contacts are crucial for Android forensics.

upvoted 0 times

...

Toshia

3 months ago

D) Phone numbers seems like the obvious choice here. Who doesn't love a good old-fashioned phone number extraction?

upvoted 0 times

Emogene

1 months ago

C) SMS messages might contain valuable information that needs to be manually extracted.

upvoted 0 times

...

Salena

1 months ago

A) Deleted images could also be important to manually carve out during the examination.

upvoted 0 times

...

Stefan

3 months ago

I see your point, but I still think deleted images are more important to carve out manually.

upvoted 0 times

...

Gilma

3 months ago

I think the answer is C) SMS messages. Those are often stored in a different location and require more manual extraction.

upvoted 0 times

Carin

27 days ago

D) Phone numbers may be part of the contacts extraction process.

upvoted 0 times

...

Lea

28 days ago

C) SMS messages often need to be manually carved out.

upvoted 0 times

...

Danica

1 months ago

B) Contacts can usually be extracted easily.

upvoted 0 times

...

Eloisa

1 months ago

A) Deleted images can sometimes be recovered automatically.

upvoted 0 times

...

Scot

3 months ago

I disagree, I believe it is SMS messages that need to be examined manually.

upvoted 0 times

...

Stefan

3 months ago

I think the artifact that must be carved out manually is deleted images.

upvoted 0 times

...