Mac Forensics DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a macOS forensic examination, you need to determine which user accounts were recently added and when they last logged in. Which set of artifacts would provide the most direct evidence?

   • AThe /Library/Preferences/com.apple.loginwindow.plist and the /var/log/install.log file.
   • BThe /private/var/db/dslocal/nodes/Default/users directory and the unified log entries from the 'loginwindow' process.
   • CThe /Users directory listing and the /var/log/wtmp file.
   • DThe /var/db/dslocal/nodes/Default/users directory and the /var/log/system.log file.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An examiner receives a MacBook Pro that was used to download sensitive documents. The system runs macOS 11 Big Sur with FileVault enabled. The examiner needs to acquire the user's Documents folder while preserving metadata. Which acquisition approach is most appropriate?

   • AUse a forensic tool that supports APFS and FileVault, such as a write-blocker with a logical acquisition of the user's home folder.
   • BCreate a Time Machine backup of the Mac and restore it to another Mac for analysis.
   • CBoot the Mac into target disk mode and connect it to a forensic workstation to image the entire disk.
   • DRemove the SSD and connect it directly to a write-blocker to perform a physical acquisition.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which macOS file stores the list of user accounts and their unique identifiers (UIDs)?

   • A/etc/shadow
   • B/etc/passwd
   • C/etc/group
   • D/etc/hosts
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic examiner is analyzing a Mac and needs to determine if a user accessed a specific website using Safari, but the user has cleared the browsing history. Which alternative artifacts could provide evidence of the website visit?

   • AThe user's ~/Library/Preferences/com.apple.Safari.plist
   • BThe Safari cache files in ~/Library/Caches/com.apple.Safari
   • CThe Spotlight index for the website's title
   • DThe system's /var/log/access.log
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is investigating a Mac where a user may have logged in remotely via SSH. The analyst needs to determine if there were any successful SSH logins. Which artifact should the analyst examine?

   • AThe /var/log/secure.log file
   • BThe unified log with predicate 'process == "sshd"'
   • CThe user's ~/.ssh/known_hosts file
   • DThe /var/log/authd.log file
   Reveal Solution Discussion Select an answer first