Apple Application Analysis GIME Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   You are analyzing a device to determine if a user visited a specific city and used a navigation app during the trip. Which data source would provide the most direct evidence of the navigation activity?

   • AWallet transaction history, which may show purchases in the city.
   • BMaps app database, which contains search history and route details.
   • CPhotos metadata, which may include GPS coordinates of photos taken in the city.
   • DScreen Time data, which shows the duration of Maps app usage.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   In a corporate investigation, you have a macOS device and an iPhone. The employee is suspected of leaking a client list. The macOS device has a Notes database with a note containing client names, and the iPhone has a Contacts database with the same names. Screen Time data on the iPhone shows the Notes app was used heavily during off-hours. You need to determine if the note was created on the macOS device and then synced to the iPhone. Which approach would best establish the timeline?

   • ACompare the creation and modification timestamps of the note in the macOS Notes database with the sync timestamps in the iPhone's Notes database.
   • BAnalyze the Screen Time data on the iPhone to see when the Notes app was used, and assume the note was created then.
   • CExamine the Contacts database on the iPhone to see when the client names were added.
   • DCheck the macOS device's system logs for iCloud sync activity.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are investigating whether a child used a prohibited app during school hours. The iPhone has Screen Time enabled, but the child also has an Apple Watch. Which data source would provide the most reliable evidence of app usage during those hours?

   • AThe iPhone's battery usage statistics for that app.
   • BThe child's Notes app entries about using the app.
   • CThe Apple Watch's activity rings and workout data.
   • DThe iPhone's Screen Time database for the app's usage during school hours.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a forensic examination of a macOS device, you locate the Contacts app's SQLite database and need to extract all contact entries, including those linked to a Notes app mention and a Maps search for the contact's address. Which approach correctly retrieves the data while preserving the original database for evidence?

   • AOpen the Contacts database in a text editor and manually copy the relevant fields.
   • BCopy the Contacts database file to an external forensic drive, then query the copy with sqlite3 to extract contact records.
   • CQuery the live Contacts database directly using sqlite3 and export results to a CSV file.
   • DUse the Contacts app's export feature to create a vCard file, then parse the vCard for contact details.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You are analyzing a macOS Photos library to determine when a specific photo was taken and whether it was edited. Which combination of data will give you the most accurate answer?

   • AThe photo's filename and the folder it is stored in.
   • BThe photo's EXIF metadata and the Photos database's edit history records.
   • CThe photo's location data and the Maps search history on the device.
   • DThe photo's thumbnail and the file size.
   Reveal Solution Discussion Select an answer first