GIAC Advanced Smartphone Forensics (GASF)

Here you have the best GIAC GASF practice exam questions

  • You have 71 total questions across 15 pages (5 per page)
  • These questions were last updated on April 13, 2026
  • This site is not affiliated with or endorsed by GIAC.
Question 1 of 71

Based on the image below, which file system is being examined?

Exam GASF: Question 1 - Image 1
Answer

Suggested Answer

The suggested answer is A.

Reference:
https://forums.techguy.org/threads/virus-in-china-mobile.992051/
Question 2 of 71

What type of acquisition is being examined in the image below?

Exam GASF: Question 2 - Image 1
Answer

Suggested Answer

The suggested answer is C.

Reference:
http://www.forensicswiki.org/wiki/How_To_Decrypt_Android_Full_Disk_Encryption
Question 3 of 71

Which of the following files contains details regarding the encryption state of an iTunes backup file?

Answer

Suggested Answer

The suggested answer is C.

The Manifest.plist lists if the backup is encrypted. This will come into use and be required should the backup file need to be accessed forensically if it is locked. The Manifest.mbdb contains a listing of data stored in the backup. Even if the backup is encrypted, this data can be parsed for more information.
Reference:
http://resources.infosecinstitute.com/ios-5-backups-part-1/#gref
Question 4 of 71

In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

Answer

Suggested Answer

The suggested answer is C.

Special considerations when analyzing data from BlackBerry OS 10 devices:
✑ You must have the device passcode as well as the BlackBerry Link password in order to backup or view this data
✑ This requires an Internet connection on the processing machine because you are authenticating to the BlackBerry
Link Server to authenticate the username and password
✑ You may encounter issues when attempting to acquire a BES-enabled device.
Question 5 of 71

The device pictured below is in Download Mode to attempt a physical acquisition. What can be ascertained by viewing the Android boot screen below?

Exam GASF: Question 5 - Image 1
Answer

Suggested Answer

The suggested answer is C.

Reference:
https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

About the GIAC GASF Certification Exam

About the Exam

The GIAC GASF (GIAC Advanced Smartphone Forensics (GASF)) validates your knowledge and skills. Passing demonstrates proficiency and can boost your career prospects in the field.

How to Prepare

Work through all 71 practice questions across 15 pages. Focus on understanding the reasoning behind each answer rather than memorizing responses to be ready for any variation on the real exam.

Why Practice Exams?

Practice exams help you familiarize yourself with the question format, manage your time, and reduce anxiety on the test day. Our GASF questions are regularly updated to reflect the latest exam objectives.