Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location
Mob_nav_barsMENU

GIAC Exam GASF Topic 2 Question 48 Discussion

Actual exam question for GIAC's GASF exam
Question #: 48
Topic #: 2
[All GASF Questions]

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Show Suggested Answer Hide Answer
Suggested Answer: C

by Karl at Jan 23, 2025, 01:30 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Sage
2 days ago
I thought it was SMS messages?
upvoted 0 times
...
Bernardo
8 days ago
Definitely deleted images!
upvoted 0 times
...
Caprice
13 days ago
I’m torn between deleted images and SMS messages. I know we discussed how some artifacts are easier to recover than others.
upvoted 0 times
...
Rodolfo
19 days ago
I feel like contacts are usually extracted automatically, but deleted images definitely require manual work.
upvoted 0 times
...
Stevie
24 days ago
I remember practicing with a similar question, and I think SMS messages might be something that needs manual extraction too.
upvoted 0 times
...
Sue
1 month ago
I think it might be deleted images, but I'm not entirely sure. We talked about how those can be tricky to recover.
upvoted 0 times
...
Cory
1 month ago
I'm a bit stumped on this one. I know there are a lot of different artifacts that can be found, but I'm not sure which one specifically needs to be manually carved out. I'll have to think it through carefully.
upvoted 0 times
...
Alesia
1 month ago
I'm pretty confident that the answer is C - SMS messages. Those are a key piece of evidence that often need to be manually extracted from an Android device.
upvoted 0 times
...
Cherri
1 month ago
Okay, let me think this through. I know that SMS messages and phone numbers are often important artifacts, but I'm not sure if those are the ones that need to be manually carved out. I'll have to review my notes on Android forensics.
upvoted 0 times
...
Josephine
1 month ago
Hmm, I'm not totally sure about this one. I know deleted images can sometimes be recovered, but I'm not sure if that's the right answer here.
upvoted 0 times
...
Lorean
1 month ago
This seems like a tricky one. I'll need to think carefully about the different types of artifacts that can be found on an Android device.
upvoted 0 times
...
Anissa
6 months ago
Wait, we're supposed to carve something out manually? I thought this was the 21st century. Can't we just use some magic forensics software?
upvoted 0 times
...
Destiny
6 months ago
A) Deleted images? Really? That's like asking me to find a needle in a haystack. I'm pretty sure the answer is C) SMS messages.
upvoted 0 times
Leota
4 months ago
Let's double check just to be sure.
upvoted 0 times
...
Roosevelt
5 months ago
No, I'm pretty confident it's C) SMS messages.
upvoted 0 times
...
Stephaine
5 months ago
Are you sure? I thought it might be B) Contacts.
upvoted 0 times
...
Paola
5 months ago
I think the answer is C) SMS messages.
upvoted 0 times
...
...
Tess
6 months ago
Hmm, I'm gonna go with B) Contacts. Can't have a proper Android forensics without digging through someone's contact list, right?
upvoted 0 times
Edgar
5 months ago
True, but don't forget about A) Deleted images, they can contain valuable information too.
upvoted 0 times
...
Thersa
5 months ago
Actually, C) SMS messages are also important to manually carve out.
upvoted 0 times
...
Albina
5 months ago
I think you're right, B) Contacts are crucial for Android forensics.
upvoted 0 times
...
...
Toshia
7 months ago
D) Phone numbers seems like the obvious choice here. Who doesn't love a good old-fashioned phone number extraction?
upvoted 0 times
Emogene
6 months ago
C) SMS messages might contain valuable information that needs to be manually extracted.
upvoted 0 times
...
Salena
6 months ago
A) Deleted images could also be important to manually carve out during the examination.
upvoted 0 times
...
...
Stefan
7 months ago
I see your point, but I still think deleted images are more important to carve out manually.
upvoted 0 times
...
Gilma
7 months ago
I think the answer is C) SMS messages. Those are often stored in a different location and require more manual extraction.
upvoted 0 times
Carin
5 months ago
D) Phone numbers may be part of the contacts extraction process.
upvoted 0 times
...
Lea
5 months ago
C) SMS messages often need to be manually carved out.
upvoted 0 times
...
Danica
5 months ago
B) Contacts can usually be extracted easily.
upvoted 0 times
...
Eloisa
5 months ago
A) Deleted images can sometimes be recovered automatically.
upvoted 0 times
...
...
Scot
7 months ago
I disagree, I believe it is SMS messages that need to be examined manually.
upvoted 0 times
...
Stefan
7 months ago
I think the artifact that must be carved out manually is deleted images.
upvoted 0 times
...

Save Cancel