GASF 試験問題を無料オンラインアクセス

When examining the iOS device shown below the tool indicates that there are 4 chat messages recovered from the device.

Which of the following locations may contain additional chat information?

• A.Databases installed and maintained by the application
• B.Memory ranges from a physical dump of the device
• C.Internet history plist files found in logical acquisitions
• D.IP connections used by the application

An analyst is reviewing the contents of a media card that was found without an associated device. Based on the image below, with which mobile device is it most likely that this device was once paired?

• A.Chinese Knock-off
• B.Nokia device running Symbian OS
• C.Legacy BlackBerry
• D.Android smartphone

Which of the following files provides the most accurate reflection of the device's date/timestamp related to the last device wipe?

• A./private/var/mobile/Applications/com.apple.mobilesafari/Library/history.db
• B./private/var/mobile/Applications/net.whatsapp.WhatsApp/Library/pw.dat
• C./private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
• D./private/var/mobile/Applications/com.viber/Library/Prefernces/com.viber.plist

Following the introduction of iMessage with the firmware release iOS 5, devices began storing date/ timestamps in which of the following formats?

• A.PDU SMS timestamp
• B.UNIXEPOCH
• C.Mac epoch
• D.UNIXEPCH

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

• A.Deleted images
• B.Phone numbers
• C.Contacts
• D.SMS messages