Mac Forensics DFE Practice Questions (Page 9)

Questions 41–42

1. 41foundation · easy

   Which file system is the default for macOS installations starting with macOS High Sierra (10.13)?

   • AAPFS (Apple File System)
   • BHFS+ (Mac OS Extended)
   • CFAT32
   • DexFAT
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner is analyzing a file on an APFS volume and needs to determine when the file was last modified by the user versus when the file's metadata was last changed. Which command should the examiner use to view these timestamps?

   • Astat -x /path/to/file
   • Bls -l /path/to/file
   • Cstat -f '%m %c %B' /path/to/file
   • Dmdls /path/to/file
   Reveal Solution Discussion Select an answer first