Mac Forensics DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which macOS log file records authentication events, such as successful and failed login attempts?

   • A/var/log/secure.log
   • B/var/log/system.log
   • C/var/log/install.log
   • D/var/log/wifi.log
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A Mac was found powered off, and the examiner needs to recover the contents of an encrypted messaging app that was running before shutdown. Which approach is most likely to yield useful data?

   • APerform a cold boot attack on the RAM chips.
   • BAnalyze the user's browser history for the app's web version.
   • CAcquire the hibernation file (sleepimage) from the disk.
   • DCheck the /Library/Logs/Chat.log file.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An examiner needs to acquire a Mac's disk while preserving the integrity of the evidence. The Mac is running macOS Catalina and uses APFS. Which acquisition method is most defensible in court?

   • AUse Time Machine to back up the Mac and then analyze the backup.
   • BBoot the Mac into recovery mode and use 'asr' to clone the volume to an external drive.
   • CUse 'dd' to copy the raw disk to an external drive while the Mac is running.
   • DRemove the SSD and connect it to a write-blocker, then use a forensic tool like FTK Imager to create a physical image.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which macOS database stores user login history, including successful and failed login attempts?

   • Awtmp
   • Bloginwindow
   • Clastlog
   • Dutmp
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Mac was seized while running, and the examiner needs to capture the contents of RAM. Which method is most appropriate?

   • AUse 'screencapture' to capture the screen.
   • BUse 'dd' to copy /dev/mem to a file.
   • CUse the 'strings' command on the system's swap file.
   • DUse a kernel module or tool like 'osxpmem' to dump memory to an external drive.
   Reveal Solution Discussion Select an answer first