An examiner is investigating a case where a user is suspected of copying sensitive files to a USB drive. The examiner needs to identify the specific USB device and the time it was connected. Which artifact would provide the most direct evidence of the device's connection and identification?

The user's recent items in the Finder

The Spotlight index entries for the USB drive's volume

The system's unified log entries for USB device enumeration

The APFS snapshot of the system volume

When investigating the use of a removable media device on a macOS system, which artifact would provide the most reliable evidence of data transfer to the device?

The device's unique identifier in the USB history plist

The file system journal or logs of file access

A security team suspects an employee used a personal external SSD to exfiltrate data from a company-issued MacBook Pro. The team has the MacBook and needs to identify the specific SSD model and serial number. Which artifact would provide this information?

The system.log file, which records all USB device connections.

The Spotlight index, which stores metadata for all connected devices.

The IORegistry (ioreg) data, which contains the device's IOUSBDevice class properties.

The user's Safari history, which may show downloads from the SSD.

A company policy requires that all data transfers to removable media be logged. An administrator needs to configure a Mac to ensure that every USB drive connection is recorded with the device's serial number and the user who connected it. Which approach would achieve this?

Enable Spotlight indexing for external drives.

Use the 'log show' command with a predicate for USB events.

Configure a launch daemon that runs a script to log IORegistry data and the current user to a file.

An organization's security policy requires that all USB devices be encrypted. An employee's Mac shows that a USB drive was connected, but the drive was not encrypted. The examiner needs to determine if the employee intentionally bypassed the policy. Which artifact would provide the most useful evidence of intent?

The system log showing the USB drive's connection and disconnection times.

The Spotlight index for the USB drive showing unencrypted files.

The IORegistry data showing the USB drive's vendor and product ID.

The user's browser history showing searches for 'how to disable USB encryption'.

GIAC iOS and macOS Examiner

Domain 2Objective 1

Apple File System Artifacts GIME Practice Questions (Page 3)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

Questions 11–15

11application · medium
An examiner is investigating a case where a user is suspected of copying sensitive files to a USB drive. The examiner needs to identify the specific USB device and the time it was connected. Which artifact would provide the most direct evidence of the device's connection and identification?
Select an answer first
12foundation · easy
When investigating the use of a removable media device on a macOS system, which artifact would provide the most reliable evidence of data transfer to the device?
Select an answer first
13application · medium
A security team suspects an employee used a personal external SSD to exfiltrate data from a company-issued MacBook Pro. The team has the MacBook and needs to identify the specific SSD model and serial number. Which artifact would provide this information?
Select an answer first
14application · medium
A company policy requires that all data transfers to removable media be logged. An administrator needs to configure a Mac to ensure that every USB drive connection is recorded with the device's serial number and the user who connected it. Which approach would achieve this?
Select an answer first
15expert · hard
An organization's security policy requires that all USB devices be encrypted. An employee's Mac shows that a USB drive was connected, but the drive was not encrypted. The examiner needs to determine if the employee intentionally bypassed the policy. Which artifact would provide the most useful evidence of intent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.