GIAC Exam GASF Topic 6 Question 32 Discussion

Actual exam question for GIAC's GASF exam

Question #: 32
Topic #: 6

[All GASF Questions]

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

ADeleted images

BContacts

CSMS messages

DPhone numbers

Show Suggested Answer

Suggested Answer: C

by Lenny at Jun 19, 2024, 06:13 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noble

5 months ago

Phone numbers? Really? I thought they just magically appear out of thin air. This exam is getting too technical for me.

upvoted 0 times

...

Frederick

5 months ago

Contacts, for sure. I mean, who needs those anyway? Isn't that what social media is for?

upvoted 0 times

...

Arlette

5 months ago

Hmm, I'd say deleted images for sure. Who doesn't love a little digital archaeology?

upvoted 0 times

Serina

4 months ago

B) Contacts

upvoted 0 times

...

Bambi

4 months ago

C) SMS messages

upvoted 0 times

...

Aileen

4 months ago

A) Deleted images

upvoted 0 times

...

Cassi

4 months ago

B) Contacts

upvoted 0 times

...

Mickie

4 months ago

C) SMS messages

upvoted 0 times

...

Lisha

4 months ago

A) Deleted images

upvoted 0 times

...

Rex

5 months ago

C) SMS messages

upvoted 0 times

...

Candra

5 months ago

A) Deleted images

upvoted 0 times

...

Sina

5 months ago

I think contacts should also be manually carved out, as they can provide valuable information for the investigation.

upvoted 0 times

...

Herman

5 months ago

But deleted images can be crucial evidence, so it makes sense to manually carve them out.

upvoted 0 times

...

Galen

5 months ago

I disagree, I believe it's SMS messages that need to be manually carved out.

upvoted 0 times

...

Herman

5 months ago

I think the artifact that must be carved out manually is deleted images.

upvoted 0 times

...