GIAC Exam GASF Topic 8 Question 41 Discussion

Actual exam question for GIAC's GASF exam

Question #: 41
Topic #: 8

[All GASF Questions]

Where would an examiner find evidence of an iOS update to device from one version to another?

ANOR memory

BSystem partition

CData partition

DSIM card

Show Suggested Answer

Suggested Answer: B

by Pauline at Sep 16, 2024, 08:24 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

3 hours ago

Hmm, the data partition? I'm not so sure about that one. Wouldn't the update files be in the system partition instead?

upvoted 0 times

...

12 days ago

I'd look for the evidence in the system partition. That's where the OS updates are typically stored, right?

upvoted 0 times

...

17 days ago

Actually, I believe the evidence of an iOS update can be found in the data partition, not the system partition.

upvoted 0 times

...

18 days ago

I agree with Deane, the system partition is where the iOS update would be stored.

upvoted 0 times

...

20 days ago

I think the evidence of an iOS update would be found in the system partition.

upvoted 0 times

...