Free Practice Questions for GIAC GASF Exam

Explanation

The Mobile Equipment ID (MEID), also found under the battery cover, is a 56 bit number which

replaced the ESN due to the limited number of 32 bit ESN numbers. The MEID is listed in hex, where the first byte is a regional code, next three bytes are a manufacturer code, and remaining three bytes are a

manufacturer-assigned serial number.

Explanation

Photos, SMS/MMS and call logs can be extracted from a logical acquisition of a non-jailbroken device. Once a device has been jailbroken, email can be extracted for review.

Explanation

Knowing that the application Lifeblog is often used on Symbian devices to store location and

activity data is useful. However, even if this is not well known at the start of the investigation, you can eliminateany of the Resource files (*.r) because they are generated when an application is installed and are notpopulated by user interactions.

Explanation

The International Mobile Subscriber Identity (IMSI) which is typically a 15-digit number (56 bits) consisting of three parts including the Mobile Country Code (MCC; 3 digits), Mobile Network Code (MNC; generally 3 digits in India, Malaysia, a lot of the Carribean and South America, and several other countries, may be 2-digit MNC as well), and Mobile Station Identification Number (MSIN; 9 digits in the U.S. and Canada, and 10 digits elsewhere) which are stored electronically within the SIM. The IMSI can be obtained either through analysis of the SIM or from the carrier.

Explanation

iOS devices can be defined as Apple products running the Apple iPhone operating system

including the iPhone, iPad and iPod Touch. The Apple watch runs Watch OS, which is similar to iOS. MacBook

Pros run Mac OSX and the Apple TV is using a new operating system called tvOS.

Explanation

Explanation

The Manifest.plist lists if the backup is encrypted. This will come into use and be required should the backup file need to be accessed forensically if it is locked. The Manifest.mbdb contains a listing of data stored in the backup. Even if the backup is encrypted, this data can be parsed for more information.

Explanation