MENU
When examining a file system acquisition of an Android device Which artifact must be carved out manually?
Suggested Answer: C
Get Premium GASF Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
31 comments · newest first
DO
Domitila
10 months ago
Totally agree, deleted images are the right answer!
KI
Kina
11 months ago
Wait, are you sure about that?
TE
Tennie
11 months ago
Yeah, deleted images are tricky to recover.
MA
Martha
11 months ago
I thought it was SMS messages?
JE
Jeannine
11 months ago
Definitely deleted images!
RO
Rochell
11 months ago
I’m confused; I thought phone numbers were part of the contacts, so maybe they don’t need manual carving either?
SA
Sarah
12 months ago
I feel like we practiced a question similar to this, and it was about contacts being automatically extracted.
VI
Vilma
12 months ago
I'm not entirely sure, but I remember something about SMS messages being recoverable without manual intervention.
RE
Reyes
12 months ago
I think deleted images might be the right answer since they often require manual carving during a file system acquisition.
ED
Eden
12 months ago
I'm a little confused on this one. I know we need to be able to recover deleted data, but I'm not sure if that applies to SMS messages the same way it does for things like photos or contacts. I'll have to review my notes on Android forensics before answering.
CL
Clare
12 months ago
Okay, let me see here. I'm pretty confident the answer is C - SMS messages. That's the type of data that's often stored in a less structured way, so it would need to be manually extracted from the file system acquisition.
TA
Tamekia
12 months ago
Hmm, I'm not totally sure about this one. I know deleted images and contacts can sometimes be recovered, but I'm not as familiar with the process for SMS messages. I'll have to think this through carefully.
AV
Avery
1 year ago
This one seems pretty straightforward. I think the answer is C - SMS messages. That's the kind of artifact that would need to be manually carved out from the file system acquisition.
VI
Viola
2 years ago
This question is giving me flashbacks to my forensics class. I'm gonna go with C. SMS messages - the digital breadcrumbs of life!
AR
Arletta
2 years ago
I always start with B) Contacts when examining a file system acquisition.
MA
Maybelle
2 years ago
I remember having to manually carve out C) SMS messages in my last case.
ST
Stefania
2 years ago
I think it's A) Deleted images, they can contain valuable information.
EL
Elly
2 years ago
Hold up, is this a trick question? I bet the answer is B. Contacts, because who doesn't love a good old-fashioned address book investigation?
AN
Annelle
2 years ago
Well, I think it could also be contacts because they are crucial for forensic analysis.
PE
Pete
2 years ago
Hmm, tricky one. But I think the answer has to be D. Phone numbers - gotta get all those juicy contacts!
NA
Nana
2 years ago
I'd go with A. Deleted images can reveal a lot about the user's activities, even if they tried to cover their tracks.
AN
Anjelica
2 years ago
D) Phone numbers might be useful to extract manually too.
CH
Charlene
2 years ago
B) Contacts can sometimes contain crucial evidence as well.
DE
Dewitt
2 years ago
C) SMS messages can also be important to carve out manually.
FR
Francesco
2 years ago
A) Deleted images can definitely provide valuable information.
PH
Phyliss
2 years ago
I disagree, I believe it's SMS messages that need to be manually carved out.
LA
Larue
2 years ago
Definitely C. SMS messages are often the juiciest part of an Android device investigation!
ES
Esteban
2 years ago
C) SMS messages
LA
Latia
2 years ago
B) Contacts
HA
Hassie
2 years ago
A) Deleted images
AN
Annelle
2 years ago
I think the artifact that must be carved out manually is deleted images.