GIAC Exam GASF Topic 4 Question 45 Discussion

Actual exam question for GIAC's GASF exam

Question #: 45
Topic #: 4

[All GASF Questions]

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

ADeleted images

BContacts

CSMS messages

DPhone numbers

Show Suggested Answer

Suggested Answer: C

by Loren at Nov 19, 2024, 09:07 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Viola

15 days ago

This question is giving me flashbacks to my forensics class. I'm gonna go with C. SMS messages - the digital breadcrumbs of life!

upvoted 0 times

Stefania

4 days ago

I think it's A) Deleted images, they can contain valuable information.

upvoted 0 times

...

Elly

18 days ago

Hold up, is this a trick question? I bet the answer is B. Contacts, because who doesn't love a good old-fashioned address book investigation?

upvoted 0 times

...

Annelle

19 days ago

Well, I think it could also be contacts because they are crucial for forensic analysis.

upvoted 0 times

...

Pete

22 days ago

Hmm, tricky one. But I think the answer has to be D. Phone numbers - gotta get all those juicy contacts!

upvoted 0 times

...

Nana

23 days ago

I'd go with A. Deleted images can reveal a lot about the user's activities, even if they tried to cover their tracks.

upvoted 0 times

Dewitt

7 days ago

C) SMS messages can also be important to carve out manually.

upvoted 0 times

...

Francesco

12 days ago

A) Deleted images can definitely provide valuable information.

upvoted 0 times

...

Phyliss

24 days ago

I disagree, I believe it's SMS messages that need to be manually carved out.

upvoted 0 times

...

Larue

24 days ago

Definitely C. SMS messages are often the juiciest part of an Android device investigation!

upvoted 0 times

Esteban

1 days ago

C) SMS messages

upvoted 0 times

...

Latia

2 days ago

B) Contacts

upvoted 0 times

...

Hassie

5 days ago

A) Deleted images

upvoted 0 times

...

Annelle

25 days ago

I think the artifact that must be carved out manually is deleted images.

upvoted 0 times

...