CertsPoint
Sign In Get Started
See all results for ""
Exams About Us
Sign In Get Started
Exam Overview
Exam Code GASF
Exam Name GIAC Advanced Smartphone Forensics
Vendor GIAC
Total Questions 75
Last Updated 26-Oct, 2026
Free GASF Questions Get Premium Access
Why CertsPoint?
  • Latest & Verified Questions
  • Detailed Explanations
  • Regular Updates
  • Full-Length Practice Tests
  • Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent
4.6 (398 Up Votes)
Secure Payment Privacy Protected Money Back Guarantee

Free GASF Practice Questions

Explore 6 free practice questions for the GIAC GASF exam and review the answers and explanations to support your preparation.

  1. Question 1

    Single answer

    Physical Analyzer provides a function to narrow down a search based on a timestamp, a type, a party or date.

    What is the name of this advanced searching capability?

    • Option A:

      Watchlist Editor

      Correct
    • Option B:

      Tags

      Correct
    • Option C:

      Timeline

      Correct
    • Option D:

      Event of Interest

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: C

    Explanation

    Physical Analyzer offers the Timeline feature to narrow down what happened on the smartphone during a specific time, type, party, etc.

    This is commonly used to narrow down time periods. Data that is manually carved will not be shown here.

    There is also an option to create a custom timeline specification.

  2. Question 2

    Single answer

    Which artifact(s) can be extracted from a logical image only if the device the image was acquired from was jailbroken?

    • Option A:

      SMS/MMS

      Correct
    • Option B:

      Email

      Correct
    • Option C:

      Call Logs

      Correct
    • Option D:

      Photos

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    Photos, SMS/MMS and call logs can be extracted from a logical acquisition of a non-jailbroken device. Once a device

    has been jailbroken, email can be extracted for review

  3. Question 3

    Single answer

    An Android device user is known to use Facebook to communicate with other parties under examination.


    There is no evidence of the Facebook application on the phone. If there was Facebook usage where would an examiner expect to find these artifacts?

    • Option A:

      com.android.chrome/app_chrome/Default/Local Storage

      Correct
    • Option B:

      dmappmgr.db

      Correct
    • Option C:

      /data/system/packages.xml

      Correct
    • Option D:

      AndroidManifest.xml

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    Reference:https://www.ctsforensics.com/assets/news/35550_Web-update.pdf]

  4. Question 4

    Single answer

    Which file, found natively on most Android devices, will contain location history such as coordinates,

    physical addresses and timestamps?

    • Option A:

      /data/data/com.google.android.apps.maps/databases/da_destination_history

      Correct
    • Option B:

      /data/data/com.google.android.apps.maps/databases/search_history.db

      Correct
    • Option C:

      /data/data/com.google.android.location/files/DATA_Preferences

      Correct
    • Option D:

      /data/data/com.vznavigator.ADR6300/databases/NIMSTORE.db

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    [Reference:https://books.google.com.pk/books?id=zDibrpXTfxMC&pg=PA356&lpg=PA356&dq=data/data/, com.google

    .android.apps.maps/databases/da_destination_history&source=bl&ots=-KA8ikP4r&,

    sig=IM_QC11zGF73P3zi8Ds9LQb2eW8&hl=en&sa=X&ved=0ahUKEwjcrObe4J7aAhXENJoKHdSLCP0,

    Q6AEILzAB#v=onepage&q=data%2Fdata%2Fcom.google.android.apps.maps%2Fdatabases

    %, 2Fda_destination_history&f=false]

  5. Question 5

    Single answer

    Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values.

    This is an example of which type of mobile malware detection?

    • Option A:

      Specific-based malware detection

      Correct
    • Option B:

      Signature-based detection

      Correct
    • Option C:

      Behavioral-based detection

      Correct
    • Option D:

      Cloud based malware detection

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: B

    Explanation

    [Reference:https://security.stackexchange.com/questions/95186/what-is-the-precise-difference-

    between-asignature-based-vs-behavior-based-antiv]

  6. Question 6

    Single answer

    Property list (Plist) files are used by iOS devices to store datA. Which of the file formats below is common to

    plist files?

    • Option A:

      HTML

      Correct
    • Option B:

      SQL

      Correct
    • Option C:

      DMG

      Correct
    • Option D:

      Binary

      Correct
    Show Answer & Explanation Hide Answer & Explanation

    Correct Answer: D

    Explanation

    Property List Files (Plist files) are structured text files containing information needed for the iOS


    device and applications to function. Plist files can store information in binary or in a format that looks similar to


    an XML file and is not always easy to read, unless you utilize a Plist Editor/viewer.