MENU
Which artifact must be carved out manually when examining a file system acquisition of an Android device?
Suggested Answer: C
Get Premium GASF Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
35 comments · newest first
BR
Brice
10 months ago
Contacts are usually easy to recover, right?
TA
Taryn
11 months ago
Wait, are you sure about that?
SH
Shalon
11 months ago
Yeah, it's deleted images for sure.
SA
Sage
11 months ago
I thought it was SMS messages?
BE
Bernardo
11 months ago
Definitely deleted images!
CA
Caprice
11 months ago
I’m torn between deleted images and SMS messages. I know we discussed how some artifacts are easier to recover than others.
RO
Rodolfo
12 months ago
I feel like contacts are usually extracted automatically, but deleted images definitely require manual work.
ST
Stevie
12 months ago
I remember practicing with a similar question, and I think SMS messages might be something that needs manual extraction too.
SU
Sue
12 months ago
I think it might be deleted images, but I'm not entirely sure. We talked about how those can be tricky to recover.
CO
Cory
12 months ago
I'm a bit stumped on this one. I know there are a lot of different artifacts that can be found, but I'm not sure which one specifically needs to be manually carved out. I'll have to think it through carefully.
AL
Alesia
12 months ago
I'm pretty confident that the answer is C - SMS messages. Those are a key piece of evidence that often need to be manually extracted from an Android device.
CH
Cherri
12 months ago
Okay, let me think this through. I know that SMS messages and phone numbers are often important artifacts, but I'm not sure if those are the ones that need to be manually carved out. I'll have to review my notes on Android forensics.
JO
Josephine
12 months ago
Hmm, I'm not totally sure about this one. I know deleted images can sometimes be recovered, but I'm not sure if that's the right answer here.
LO
Lorean
1 year ago
This seems like a tricky one. I'll need to think carefully about the different types of artifacts that can be found on an Android device.
AN
Anissa
1 year ago
Wait, we're supposed to carve something out manually? I thought this was the 21st century. Can't we just use some magic forensics software?
DE
Destiny
1 year ago
A) Deleted images? Really? That's like asking me to find a needle in a haystack. I'm pretty sure the answer is C) SMS messages.
LE
Leota
1 year ago
Let's double check just to be sure.
RO
Roosevelt
1 year ago
No, I'm pretty confident it's C) SMS messages.
ST
Stephaine
1 year ago
Are you sure? I thought it might be B) Contacts.
PA
Paola
1 year ago
I think the answer is C) SMS messages.
TE
Tess
1 year ago
Hmm, I'm gonna go with B) Contacts. Can't have a proper Android forensics without digging through someone's contact list, right?
ED
Edgar
1 year ago
True, but don't forget about A) Deleted images, they can contain valuable information too.
TH
Thersa
1 year ago
Actually, C) SMS messages are also important to manually carve out.
AL
Albina
1 year ago
I think you're right, B) Contacts are crucial for Android forensics.
TO
Toshia
1 year ago
D) Phone numbers seems like the obvious choice here. Who doesn't love a good old-fashioned phone number extraction?
EM
Emogene
1 year ago
C) SMS messages might contain valuable information that needs to be manually extracted.
SA
Salena
1 year ago
A) Deleted images could also be important to manually carve out during the examination.
ST
Stefan
1 year ago
I see your point, but I still think deleted images are more important to carve out manually.
GI
Gilma
1 year ago
I think the answer is C) SMS messages. Those are often stored in a different location and require more manual extraction.
CA
Carin
1 year ago
D) Phone numbers may be part of the contacts extraction process.
LE
Lea
1 year ago
C) SMS messages often need to be manually carved out.
DA
Danica
1 year ago
B) Contacts can usually be extracted easily.
EL
Eloisa
1 year ago
A) Deleted images can sometimes be recovered automatically.
SC
Scot
2 years ago
I disagree, I believe it is SMS messages that need to be examined manually.
ST
Stefan
2 years ago
I think the artifact that must be carved out manually is deleted images.