New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GASF Exam - Topic 2 Question 48 Discussion

Actual exam question for GIAC's GASF exam
Question #: 48
Topic #: 2
[All GASF Questions]

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Show Suggested Answer Hide Answer
Suggested Answer: C

by Karl at Jan 23, 2025, 01:30 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Brice
3 months ago
Contacts are usually easy to recover, right?
upvoted 0 times
...
Taryn
3 months ago
Wait, are you sure about that?
upvoted 0 times
...
Shalon
3 months ago
Yeah, it's deleted images for sure.
upvoted 0 times
...
Sage
4 months ago
I thought it was SMS messages?
upvoted 0 times
...
Bernardo
4 months ago
Definitely deleted images!
upvoted 0 times
...
Caprice
4 months ago
I’m torn between deleted images and SMS messages. I know we discussed how some artifacts are easier to recover than others.
upvoted 0 times
...
Rodolfo
4 months ago
I feel like contacts are usually extracted automatically, but deleted images definitely require manual work.
upvoted 0 times
...
Stevie
4 months ago
I remember practicing with a similar question, and I think SMS messages might be something that needs manual extraction too.
upvoted 0 times
...
Sue
5 months ago
I think it might be deleted images, but I'm not entirely sure. We talked about how those can be tricky to recover.
upvoted 0 times
...
Cory
5 months ago
I'm a bit stumped on this one. I know there are a lot of different artifacts that can be found, but I'm not sure which one specifically needs to be manually carved out. I'll have to think it through carefully.
upvoted 0 times
...
Alesia
5 months ago
I'm pretty confident that the answer is C - SMS messages. Those are a key piece of evidence that often need to be manually extracted from an Android device.
upvoted 0 times
...
Cherri
5 months ago
Okay, let me think this through. I know that SMS messages and phone numbers are often important artifacts, but I'm not sure if those are the ones that need to be manually carved out. I'll have to review my notes on Android forensics.
upvoted 0 times
...
Josephine
5 months ago
Hmm, I'm not totally sure about this one. I know deleted images can sometimes be recovered, but I'm not sure if that's the right answer here.
upvoted 0 times
...
Lorean
5 months ago
This seems like a tricky one. I'll need to think carefully about the different types of artifacts that can be found on an Android device.
upvoted 0 times
...
Anissa
9 months ago
Wait, we're supposed to carve something out manually? I thought this was the 21st century. Can't we just use some magic forensics software?
upvoted 0 times
...
Destiny
9 months ago
A) Deleted images? Really? That's like asking me to find a needle in a haystack. I'm pretty sure the answer is C) SMS messages.
upvoted 0 times
Leota
8 months ago
Let's double check just to be sure.
upvoted 0 times
...
Roosevelt
8 months ago
No, I'm pretty confident it's C) SMS messages.
upvoted 0 times
...
Stephaine
8 months ago
Are you sure? I thought it might be B) Contacts.
upvoted 0 times
...
Paola
8 months ago
I think the answer is C) SMS messages.
upvoted 0 times
...
...
Tess
9 months ago
Hmm, I'm gonna go with B) Contacts. Can't have a proper Android forensics without digging through someone's contact list, right?
upvoted 0 times
Edgar
8 months ago
True, but don't forget about A) Deleted images, they can contain valuable information too.
upvoted 0 times
...
Thersa
8 months ago
Actually, C) SMS messages are also important to manually carve out.
upvoted 0 times
...
Albina
9 months ago
I think you're right, B) Contacts are crucial for Android forensics.
upvoted 0 times
...
...
Toshia
10 months ago
D) Phone numbers seems like the obvious choice here. Who doesn't love a good old-fashioned phone number extraction?
upvoted 0 times
Emogene
9 months ago
C) SMS messages might contain valuable information that needs to be manually extracted.
upvoted 0 times
...
Salena
9 months ago
A) Deleted images could also be important to manually carve out during the examination.
upvoted 0 times
...
...
Stefan
11 months ago
I see your point, but I still think deleted images are more important to carve out manually.
upvoted 0 times
...
Gilma
11 months ago
I think the answer is C) SMS messages. Those are often stored in a different location and require more manual extraction.
upvoted 0 times
Carin
9 months ago
D) Phone numbers may be part of the contacts extraction process.
upvoted 0 times
...
Lea
9 months ago
C) SMS messages often need to be manually carved out.
upvoted 0 times
...
Danica
9 months ago
B) Contacts can usually be extracted easily.
upvoted 0 times
...
Eloisa
9 months ago
A) Deleted images can sometimes be recovered automatically.
upvoted 0 times
...
...
Scot
11 months ago
I disagree, I believe it is SMS messages that need to be examined manually.
upvoted 0 times
...
Stefan
11 months ago
I think the artifact that must be carved out manually is deleted images.
upvoted 0 times
...

Save Cancel