Mac Forensics DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is analyzing a Mac and needs to determine which applications were installed and when. Which artifacts would provide the most reliable installation timeline?

   • AThe /Library/Receipts/InstallHistory.plist and the unified log entries for 'installer'
   • BThe /Applications folder's modification times
   • CThe /var/log/install.log file
   • DThe user's ~/Library/Preferences/com.apple.LaunchServices.plist
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a Mac forensic investigation, you need to recover the contents of an encrypted chat application that was running in memory. The Mac was shut down normally. Which source would be most likely to contain remnants of the chat data?

   • AThe /var/vm/sleepimage file.
   • BThe /var/log/system.log file.
   • CThe /Library/Logs/Chat.log file.
   • DThe user's browser history plist.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which command-line tool in macOS can be used to create a forensic image of a disk?

   • Adiskutil
   • Bsips
   • Chdiutil
   • Ddd
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In macOS, where are per-user application preferences typically stored?

   • A/Library/Preferences
   • B/Users/<username>/Library/Preferences
   • C/System/Library/Preferences
   • D/Users/<username>/Documents
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An investigator wants to identify which applications launch automatically when a specific user logs into their Mac. Which artifacts should be examined?

   • AThe /Library/StartupItems folder and the user's bash profile.
   • BThe /Library/LaunchDaemons folder and the system.log file.
   • CThe user's LaunchAgents folder and the com.apple.loginitems.plist file.
   • DThe /etc/rc.common file and the user's crontab.
   Reveal Solution Discussion Select an answer first