New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GASF Exam - Topic 4 Question 45 Discussion

Actual exam question for GIAC's GASF exam
Question #: 45
Topic #: 4
[All GASF Questions]

When examining a file system acquisition of an Android device Which artifact must be carved out manually?

Show Suggested Answer Hide Answer
Suggested Answer: C

by Loren at Nov 19, 2024, 09:07 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Domitila
3 months ago
Totally agree, deleted images are the right answer!
upvoted 0 times
...
Kina
3 months ago
Wait, are you sure about that?
upvoted 0 times
...
Tennie
3 months ago
Yeah, deleted images are tricky to recover.
upvoted 0 times
...
Martha
4 months ago
I thought it was SMS messages?
upvoted 0 times
...
Jeannine
4 months ago
Definitely deleted images!
upvoted 0 times
...
Rochell
4 months ago
I’m confused; I thought phone numbers were part of the contacts, so maybe they don’t need manual carving either?
upvoted 0 times
...
Sarah
4 months ago
I feel like we practiced a question similar to this, and it was about contacts being automatically extracted.
upvoted 0 times
...
Vilma
4 months ago
I'm not entirely sure, but I remember something about SMS messages being recoverable without manual intervention.
upvoted 0 times
...
Reyes
5 months ago
I think deleted images might be the right answer since they often require manual carving during a file system acquisition.
upvoted 0 times
...
Eden
5 months ago
I'm a little confused on this one. I know we need to be able to recover deleted data, but I'm not sure if that applies to SMS messages the same way it does for things like photos or contacts. I'll have to review my notes on Android forensics before answering.
upvoted 0 times
...
Clare
5 months ago
Okay, let me see here. I'm pretty confident the answer is C - SMS messages. That's the type of data that's often stored in a less structured way, so it would need to be manually extracted from the file system acquisition.
upvoted 0 times
...
Tamekia
5 months ago
Hmm, I'm not totally sure about this one. I know deleted images and contacts can sometimes be recovered, but I'm not as familiar with the process for SMS messages. I'll have to think this through carefully.
upvoted 0 times
...
Avery
5 months ago
This one seems pretty straightforward. I think the answer is C - SMS messages. That's the kind of artifact that would need to be manually carved out from the file system acquisition.
upvoted 0 times
...
Viola
1 year ago
This question is giving me flashbacks to my forensics class. I'm gonna go with C. SMS messages - the digital breadcrumbs of life!
upvoted 0 times
Arletta
1 year ago
I always start with B) Contacts when examining a file system acquisition.
upvoted 0 times
...
Maybelle
1 year ago
I remember having to manually carve out C) SMS messages in my last case.
upvoted 0 times
...
Stefania
1 year ago
I think it's A) Deleted images, they can contain valuable information.
upvoted 0 times
...
...
Elly
1 year ago
Hold up, is this a trick question? I bet the answer is B. Contacts, because who doesn't love a good old-fashioned address book investigation?
upvoted 0 times
...
Annelle
1 year ago
Well, I think it could also be contacts because they are crucial for forensic analysis.
upvoted 0 times
...
Pete
1 year ago
Hmm, tricky one. But I think the answer has to be D. Phone numbers - gotta get all those juicy contacts!
upvoted 0 times
...
Nana
1 year ago
I'd go with A. Deleted images can reveal a lot about the user's activities, even if they tried to cover their tracks.
upvoted 0 times
Anjelica
1 year ago
D) Phone numbers might be useful to extract manually too.
upvoted 0 times
...
Charlene
1 year ago
B) Contacts can sometimes contain crucial evidence as well.
upvoted 0 times
...
Dewitt
1 year ago
C) SMS messages can also be important to carve out manually.
upvoted 0 times
...
Francesco
1 year ago
A) Deleted images can definitely provide valuable information.
upvoted 0 times
...
...
Phyliss
1 year ago
I disagree, I believe it's SMS messages that need to be manually carved out.
upvoted 0 times
...
Larue
1 year ago
Definitely C. SMS messages are often the juiciest part of an Android device investigation!
upvoted 0 times
Esteban
1 year ago
C) SMS messages
upvoted 0 times
...
Latia
1 year ago
B) Contacts
upvoted 0 times
...
Hassie
1 year ago
A) Deleted images
upvoted 0 times
...
...
Annelle
1 year ago
I think the artifact that must be carved out manually is deleted images.
upvoted 0 times
...

Save Cancel