Question 6 of 71

An analyst investigating a Nokia S60 Symbian device wants to know if an Adobe Flash file on the handset is compromised. Which file in the image will best target the Adobe Flash files?

Exam GASF: Question 6 - Image 1
Answer

Suggested Answer

The suggested answer is A.

A sis.file is the package that Symbian uses to install applications on their OS compatible handsets. Knowing that you are investigating an application that is installed on the handset, first narrowing the files down to installer packages, or *.sis files, is a good starting point. Flash is an Adobe product making the most logical of the two remaining* .sis files for review, the FLASHLITE installer package. There are several other files related to "Flash" but as resource files, they provide supporting documentation and will not contain the .app file or code that was possibly malicious.
Question 7 of 71

As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on applications that were accessed with the handset?

Answer

Suggested Answer

The suggested answer is C.

Analyzing both the Event Logs (which are accessible in Oxygen Forensic Suite) and/or the Installed Applications (which is a feature available in
Cellebrite Physical Analyzer) may lead you to additional data. If applications of interest were located in the Event Logs, a Keyword Search across the media may reveal more data related to the application.
Question 8 of 71

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Answer

Suggested Answer

The suggested answer is C.

Question 9 of 71

When conducting forensic analysis of an associated media card, one would most often expect to find this particular file system format?

Answer

Suggested Answer

The suggested answer is D.

Question 10 of 71

Cellebrite Physical Analyzer uses Bit Defender to scan for malware by flagging files who have known bad hash values. This is an example of which type of mobile malware detection?

Answer

Suggested Answer

The suggested answer is B.

Reference:
https://security.stackexchange.com/questions/95186/what-is-the-precise-difference-between-a-signature-based-vs-behavior-based-antiv