A forensic examiner is asked to recover deleted files from an APFS volume. The Mac was used for several weeks after deletion. Which factor most significantly impacts the likelihood of recovery?

The use of FileVault encryption prevents any recovery of deleted files.

The file was moved to the Trash and can be restored from there.

The file's metadata is still present in the APFS catalog, making recovery straightforward.

The file system's copy-on-write mechanism may have overwritten the deleted file's data blocks.

A forensic analyst needs to capture the contents of RAM from a running Mac without altering the system. Which method should the analyst use?

Use the 'log collect' command to gather system logs

Use the 'sudo dd' command to read /dev/mem

Use the built-in 'vmware' command to snapshot memory

Use a kernel extension like 'osxpmem' to dump memory

An examiner is analyzing an APFS volume and notices that a file's modification timestamp is earlier than its creation timestamp. What is the most plausible explanation?

The file was created on a system with a different time zone, and the timestamps were not converted correctly.

The file system has a bug that causes timestamp corruption.

The file's creation timestamp was changed by a user or application.

The file was copied from a file system that does not support creation timestamps.

An examiner is investigating a Mac where a user allegedly accessed a classified document. The user claims they never logged in during the time of access. Which artifact would most likely disprove this claim?

The user's browser history showing no visits to the document's location.

The system's sleep/wake logs showing the Mac was asleep during the time.

The unified log entries for the 'loginwindow' process showing a successful login.

Which macOS file contains the contents of RAM when the system enters hibernation mode?

/Library/Preferences/com.apple.PowerManagement.plist

/System/Library/CoreServices/hibernatemode

EC-CouncilDigital Forensics Essentials

Domain 4Objective 5

Mac Forensics DFE Practice Questions (Page 1)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

42questions here

9free pages

8concepts

Questions 1–5

1expert · hard
A forensic examiner is asked to recover deleted files from an APFS volume. The Mac was used for several weeks after deletion. Which factor most significantly impacts the likelihood of recovery?
Select an answer first
2application · medium
A forensic analyst needs to capture the contents of RAM from a running Mac without altering the system. Which method should the analyst use?
Select an answer first
3expert · hard
An examiner is analyzing an APFS volume and notices that a file's modification timestamp is earlier than its creation timestamp. What is the most plausible explanation?
Select an answer first
4expert · medium
An examiner is investigating a Mac where a user allegedly accessed a classified document. The user claims they never logged in during the time of access. Which artifact would most likely disprove this claim?
Select an answer first
5foundation · easy
Which macOS file contains the contents of RAM when the system enters hibernation mode?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.