GIAC Exam GASF Topic 2 Question 48 Discussion

Actual exam question for GIAC's GASF exam

Question #: 48
Topic #: 2

[All GASF Questions]

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

ADeleted images

BContacts

CSMS messages

DPhone numbers

Show Suggested Answer

Suggested Answer: C

by Karl at Jan 23, 2025, 01:30 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

3 days ago

D) Phone numbers seems like the obvious choice here. Who doesn't love a good old-fashioned phone number extraction?

upvoted 0 times

...

6 days ago

I see your point, but I still think deleted images are more important to carve out manually.

upvoted 0 times

...

6 days ago

I think the answer is C) SMS messages. Those are often stored in a different location and require more manual extraction.

upvoted 0 times

...

12 days ago

I disagree, I believe it is SMS messages that need to be examined manually.

upvoted 0 times

...

14 days ago

I think the artifact that must be carved out manually is deleted images.

upvoted 0 times

...