Free GASF Practice Questions

Question 1

A powered-on iPhone 15 Pro is seized during a search warrant execution. The screen is unlocked and the examiner has approximately two minutes on scene. Which action BEST preserves the greatest volume of recoverable evidence?

Accepted Answer

Isolate it powered and unlocked inside a charging-capable Faraday bag

Answer

Power it down at once, since a remote wipe would otherwise destroy all recoverable evidence

Answer

Seal it in a standard Faraday bag, which blocks a remote wipe

Answer

Disable the passcode so the lab keeps access later

Question 2

An examiner has a locked iPhone 11 running current iOS, with no passcode available. A colleague suggests using checkm8 to obtain a full file system extraction. The examiner should respond that checkm8:

Accepted Answer

Does not apply, as its scope ends at the A11 and this device runs an A13

Answer

Will work, but only once the device is placed into DFU mode over a USB connection

Answer

Was patched by Apple in a subsequent iOS update and no longer functions on current firmware

Answer

Will work only if USB Restricted Mode has not engaged since the device was last unlocked

Question 3

A cooperative suspect provides an unlocked iPhone and consents to a backup-based collection. No backup password is currently set. To maximize the data recovered, the examiner should:

Accepted Answer

Set a known backup password on the device first, then create an encrypted backup from it

Answer

Create the backup as-is, then recover the keychain by cracking it with Hashcat afterwards

Answer

Enable iCloud Backup instead, then obtain the complete backup from Apple by legal process

Answer

Create the backup as-is, since unencrypted backups parse without a decryption step

Question 4

An examiner exports chat.db from a full file system extraction by copying only that single file to a working directory. A commercial tool then reports 412 messages. A colleague re-parses the original extraction and reports 439. The MOST likely explanation is that the examiner's copy omitted:

Accepted Answer

The write-ahead log, which held records not yet checkpointed into the main database file

Answer

The rollback journal, which held the 27 records

Answer

The overflow pages, which SQLite keeps outside the main file

Answer

The freelist, which SQLite keeps in a separate index

Question 5

A SQLite field in an iOS artifact contains the value 700000000. The examiner converts it using the Unix epoch and obtains a date in 1992, which is inconsistent with the device's manufacture date. The value MOST likely represents:

Accepted Answer

Mac Absolute Time, resolving to approximately 2023

Answer

Nanoseconds since the Mac epoch, resolving to a fraction of a second after January 2001

Answer

A Unix timestamp expressed in milliseconds, resolving to the first week of January 1970

Answer

WebKit time counted from the 1601 epoch, resolving to approximately the year 2001

Question 6

A tool reports that a chat database contains no recoverable deleted records. Before accepting this conclusion, the examiner should FIRST determine whether:

Accepted Answer

The database has been vacuumed, discarding its free pages and unallocated content

Answer

The schema version postdates the parser build shipped with this release of the tool

Answer

The database uses a text encoding the carving engine cannot interpret

Answer

The tool's licence tier includes parser support for this particular application

Question 7

Which statement about SQLite freelist pages is accurate?

Accepted Answer

They may retain intact record content until the engine reuses them

Answer

They are zeroed the moment a DELETE commits, unless secure_delete has been explicitly disabled

Answer

They exist only in write-ahead log journal mode

Answer

They are held in the -shm file and discarded on close

Question 8

An Android 14 device is seized in a powered-off state and booted in the lab without the user's credential. Which data is available to the examiner?

Accepted Answer

Data in Device Encrypted storage, which remains readable before the credential is entered and serves Direct Boot-aware apps

Answer

Credential Encrypted storage, which unlocks automatically at boot

Answer

No user data, since file-based encryption covers userdata as one volume

Answer

All application data, once the examiner unlocks the bootloader for root

Question 9

An examiner receives a microSD card removed from a Samsung device. The card contains data but presents no readable file system. The device itself was not seized. The MOST likely explanation is that the card:

Accepted Answer

Was formatted as adopted storage, keyed to the device

Answer

Was wiped with a secure-erase utility before it reached the examiner's custody

Answer

Holds a vault application's encrypted container, which conceals the volume structure

Answer

Uses exFAT, requiring a separately licensed parser the examiner's tool does not include

Question 10

A tool reports a device location in Hamburg at 02:14, with an accuracy value of 4200. The suspect denies ever being in Hamburg. The MOST defensible characterization of this artifact is that it:

Accepted Answer

Places the device within a radius of several kilometres and requires corroboration

Answer

Confirms presence in Hamburg, as the accuracy field expresses confidence as a percentage

Answer

Places the device within 4.2 metres of the recorded coordinates at that time

Answer

Is a tool artefact, since accuracy values above 1000 fall outside the valid range

Free GASF Practice Questions

Domain 1: Android Device Application Analysis

Question 1

Question 2

Question 3

Domain 2: Android Device File System Artifacts

Question 4

Question 5

Question 6

Question 7

Domain 3: Apple Device Application Analysis

Question 8

Question 9

Domain 4: Apple Device File System Artifacts

Question 10

The rest of the GASF blueprint

That's 10 of 1,050