Apple File System Artifacts GIME Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What type of information can be recovered from Spotlight index files during a forensic examination?

   • AThe user's login passwords
   • BThe full contents of all indexed files
   • CFile metadata, search history, and usage patterns
   • DOnly the names of files that are currently present on the system
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is examining a Mac that was used to access sensitive documents. The user cleared the Finder's 'Recent Items' and deleted the documents. The analyst needs to recover evidence of the file names and the times they were accessed. Which artifact would be most useful?

   • AThe .DS_Store file in the user's home directory.
   • BThe system's sleep/wake logs.
   • CThe Spotlight index (.store) files in the /.Spotlight-V100 directory.
   • DThe user's bash history file.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An examiner is investigating a Mac where a user allegedly deleted incriminating files and then connected a USB drive. The examiner has the following evidence: (1) The file system journal shows the files were deleted at 10:00 AM. (2) The unified log shows a USB drive was connected at 10:05 AM. (3) The user's login history shows they logged in at 9:55 AM. The examiner needs to determine if the user could have copied the files to the USB drive before deleting them. Which conclusion is most defensible?

   • AThe user could have copied the files because the USB drive connection time is not precise.
   • BThe user definitely copied the files because they logged in before the deletion.
   • CThe user could not have copied the files because the deletion occurred before the USB drive was connected.
   • DThe user could have copied the files before deletion, but there is no evidence of this.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An administrator needs to audit system configuration changes on a Mac, such as changes to network settings or user accounts. Which artifact would provide a comprehensive history of these changes?

   • AThe Spotlight index for system files.
   • BThe user's .zsh_history file.
   • CThe /var/log/system.log file.
   • DThe unified logging system, specifically the 'log show --predicate' for configuration events.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An examiner is analyzing a macOS system where a user is suspected of using a VPN to hide their activity. The examiner wants to determine if the user accessed a specific file during a VPN session. The system's unified log shows the VPN connection, but the APFS journal does not show any file access during that time. The Spotlight index shows the file was accessed at a time that overlaps with the VPN session. Which of the following is the most likely explanation?

   • AThe Spotlight index is unreliable and the file was not actually accessed.
   • BThe VPN connection prevented the APFS journal from recording the access.
   • CThe file access was performed by a process that does not generate APFS journal entries, such as a direct read from a memory-mapped file.
   • DThe APFS journal does not record file reads, only writes, so the absence of journal entries is expected.
   Reveal Solution Discussion Select an answer first