Mac Forensics DFE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A forensic examiner is trying to reconstruct the timeline of a user's activities on a Mac. Which combination of artifacts would provide the most comprehensive timeline?

   • AOnly the user's bash history and shell logs.
   • BOnly the system's sleep/wake logs.
   • CUnified logs, file system timestamps, and browser history.
   • DOnly the application crash reports.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A forensic examiner is investigating a Mac where a user allegedly accessed sensitive files. The examiner has a full disk image and needs to determine if the user accessed a specific file, but the file's access timestamp has not been updated due to the 'noatime' mount option. Which alternative artifacts should the examiner analyze to prove access?

   • AThe file's extended attributes and the system's /var/log/access.log
   • BThe Spotlight index in /.Spotlight-V100 and the user's ~/Library/Application Support/com.apple.sharedfilelist
   • CThe file's creation timestamp and the user's shell history
   • DThe unified log entries for 'filecoordinationd' and the user's ~/Library/Preferences/com.apple.recentitems.plist
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which command-line tool in macOS is used to view and modify extended attributes of files?

   • Amdls
   • Bxattr
   • Cstat
   • Dls -l
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic analyst is investigating a Mac and needs to determine if a user logged in at a specific time. The analyst has the unified log, but the user's account is a standard user. Which log entry would provide the most reliable evidence of the login?

   • AThe 'securityd' process authentication event in the unified log
   • BThe 'loginwindow' event with 'userLogin' eventMessage
   • CThe 'loginwindow' process launch event in the unified log
   • DThe 'opendirectoryd' process event for the user's authentication
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A forensic analyst is examining a Mac and finds a file with a creation timestamp that is earlier than the installation date of the operating system. What is the most likely explanation?

   • AThe file was recovered from a deleted file system and the timestamp is corrupted.
   • BThe file was created on another system and copied to this Mac, preserving the original creation time.
   • CThe file is a system file that was pre-installed on the disk image.
   • DThe system clock was incorrect when the file was created.
   Reveal Solution Discussion Select an answer first