GIAC GASF Actual Free Exam Questions & Community Discussion

Exam Code/Number: GASF
Exam Name/Title: GIAC Advanced Smartphone Forensics
Certification Provider: GIAC
Corresponding Certification: GIAC Certification

Exam Questions: 75
Updated On: May 29, 2026

Question #25

The files pictured below from a BlackBerry OS10 file system have a unique file extension.

What can be concluded about these files?

A. Files are protected by the file system, so changing the file system makes them less accessible

B. Files are encrypted to prevent them from being viewed without the decryption key

C. Files are located on a media card so they contain a unique file extension

D. Files are encoded for secure transmitting of data

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #26

An analyst is reviewing the contents of a media card that was found without an associated device. Based on the image below, with which mobile device is it most likely that this device was once paired?

A. Nokia device running Symbian OS

B. Chinese Knock-off

C. Android smartphone

D. Legacy BlackBerry

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #27

When examining the iOS device shown below the tool indicates that there are 4 chat messages recovered from the device.

Which of the following locations may contain additional chat information?

A. Databases installed and maintained by the application

B. Internet history plist files found in logical acquisitions

C. Memory ranges from a physical dump of the device

D. IP connections used by the application

Discussion 0

Correct Answer: A Vote an answer

Question #28

Property list (Plist) files are used by iOS devices to store datA. Which of the file formats below is common to plist files?

A. SQL

B. HTML

C. DMG

D. Binary

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #29

What type of acquisition has occurred for this device?

A. File system

B. Physical

C. Bypass lock

D. Logical

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #30

Which file type below is commonly associated with locational data and is an export option from within Cellebrite Physical Analyzer and XRY to provide detailed visual output of geographic information?

A. .ipa

B. .plist

C. .xry

D. .kml

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #31

An Android device user is known to use Facebook to communicate with other parties under examination.
There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?

A. AndroidManifest.xml

B. /data/system/packages.xml

C. com.android.chrome/app_chrome/Default/Local Storage

D. dmappmgr.db

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #32

When analyzing the WhatsApp timestamp "1461184912" in iOS what timestamp conversion should be used?

A. Mac Absolute

B. Chrome

C. UNIX Epoch

D. Webkit

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free GIAC GASF Demo

Simply submit your e-mail address below to get started with our free demo of your GIAC GASF exam.