GIAC Exam GASF Topic 4 Question 45 Discussion

Actual exam question for GIAC's GASF exam

Question #: 45
Topic #: 4

[All GASF Questions]

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

ADeleted images

BContacts

CSMS messages

DPhone numbers

Show Suggested Answer

Suggested Answer: C

by Loren at Nov 19, 2024, 09:07 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Viola

5 months ago

This question is giving me flashbacks to my forensics class. I'm gonna go with C. SMS messages - the digital breadcrumbs of life!

upvoted 0 times

Arletta

4 months ago

I always start with B) Contacts when examining a file system acquisition.

upvoted 0 times

...

Maybelle

4 months ago

I remember having to manually carve out C) SMS messages in my last case.

upvoted 0 times

...

Stefania

4 months ago

I think it's A) Deleted images, they can contain valuable information.

upvoted 0 times

...

Elly

5 months ago

Hold up, is this a trick question? I bet the answer is B. Contacts, because who doesn't love a good old-fashioned address book investigation?

upvoted 0 times

...

Annelle

5 months ago

Well, I think it could also be contacts because they are crucial for forensic analysis.

upvoted 0 times

...

Pete

5 months ago

Hmm, tricky one. But I think the answer has to be D. Phone numbers - gotta get all those juicy contacts!

upvoted 0 times

...

Nana

5 months ago

I'd go with A. Deleted images can reveal a lot about the user's activities, even if they tried to cover their tracks.

upvoted 0 times

Anjelica

3 months ago

D) Phone numbers might be useful to extract manually too.

upvoted 0 times

...

Charlene

4 months ago

B) Contacts can sometimes contain crucial evidence as well.

upvoted 0 times

...

Dewitt

4 months ago

C) SMS messages can also be important to carve out manually.

upvoted 0 times

...

Francesco

4 months ago

A) Deleted images can definitely provide valuable information.

upvoted 0 times

...

Phyliss

5 months ago

I disagree, I believe it's SMS messages that need to be manually carved out.

upvoted 0 times

...

Larue

5 months ago

Definitely C. SMS messages are often the juiciest part of an Android device investigation!

upvoted 0 times

Esteban

4 months ago

C) SMS messages

upvoted 0 times

...

Latia

4 months ago

B) Contacts

upvoted 0 times

...

Hassie

4 months ago

A) Deleted images

upvoted 0 times

...

Annelle

5 months ago

I think the artifact that must be carved out manually is deleted images.

upvoted 0 times

...