GIAC Advanced Smartphone Forensics (GASF) — Question 1

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Answer options

• A. Deleted images
• B. Contacts
• C. SMS messages
• D. Phone numbers

Correct answer: C

Explanation

The correct answer is C, as SMS messages are often stored in a way that requires manual extraction during a file system analysis. The other options, such as deleted images, contacts, and phone numbers, can typically be recovered using automated tools or are stored in accessible formats.