Apple File System Artifacts GIME Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An examiner is analyzing a Mac that was used to log in, connect a USB drive, and then copy files. The examiner wants to establish the order of these events. Which artifacts would provide the most reliable sequence?

   • AThe system's configuration profiles, the user's bash history, and the APFS snapshots
   • BThe unified log, the Spotlight index, and the user's login items
   • CThe Spotlight index, the user's recent items, and the system's sleep/wake logs
   • DThe login history, the unified log for USB events, and the APFS journal
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic analyst is reviewing a Mac that was used to access a confidential database. The analyst needs to determine which user accounts were logged in during the time of the suspected access. Which artifact would provide the most reliable login history?

   • AThe Spotlight index for user activity.
   • BThe last command output, which reads from /var/log/wtmp.
   • CThe /var/log/system.log file.
   • DThe user's .zsh_history file.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an investigation, an examiner needs to determine when a specific PDF file was first created on a Mac. The file's creation date in the Finder is shown as 'January 15, 2024'. However, the examiner suspects the file was copied from an external source. Which artifact would help verify the original creation time?

   • AThe file's POSIX permissions.
   • BThe file's quarantine attribute (com.apple.quarantine).
   • CThe file's extended attributes (xattr), specifically the kMDItemDateAdded attribute.
   • DThe file's Finder comment.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An examiner is analyzing a macOS system where a user is suspected of searching for sensitive terms using Spotlight and then deleting the files that appeared in the results. The examiner has the Spotlight index and the APFS journal. The Spotlight index contains metadata for files that no longer exist on the system. The APFS journal shows the deletion of those files. Which of the following is the most likely interpretation?

   • AThe Spotlight index retained metadata after the files were deleted, and the APFS journal confirms the deletion, but the search terms themselves are not directly recoverable from the index.
   • BThe Spotlight index entries are remnants of a previous indexing of the files, and the APFS journal shows the files were never deleted.
   • CThe Spotlight index entries are from a different volume, and the APFS journal is unrelated to the deletion.
   • DThe Spotlight index contains the search terms the user entered, and the APFS journal confirms the deletion, allowing recovery of the search history.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An examiner is investigating a Mac where a user connected an external SSD and copied a large number of files. The examiner has the APFS journal from the external SSD, but the journal seems to contain only a few entries. The user is known to have used a tool that performs direct block-level copying. Which of the following is the most likely reason for the sparse journal?

   • AThe tool bypassed the file system and wrote directly to the raw device, so the APFS journal was not updated.
   • BThe APFS journal was cleared by the tool after the copy.
   • CThe APFS journal only records metadata changes, and the copy did not change metadata.
   • DThe external SSD was formatted with HFS+, which does not have a journal.
   Reveal Solution Discussion Select an answer first