A forensic examiner is investigating a macOS workstation used by a contractor who was terminated two weeks ago. The examiner needs to determine whether the contractor copied sensitive design files to a USB drive before leaving. The contractor had administrative rights and was known to use Time Machine. Which combination of artifacts would provide the most reliable evidence of the data transfer to the USB drive?

Analyze the unified logging (log show) for file system events and the IORegistry for USB device identifiers and timestamps.

Examine the Spotlight index for file metadata and the system log for USB device connection events.

Correlate the file system event timestamps of the design files with the USB device connection and disconnection times from the system log.

Compare the file system event timestamps of the design files with the last login timestamp of the contractor's user account.

An analyst is investigating a file that was deleted from an APFS volume. Which artifact would most likely retain evidence of the file's prior existence and metadata?

The file's original inode in the volume's catalog

The Spotlight index entries for the file

The file's access control list (ACL)

A forensic examiner needs to determine if a user accessed files from a specific external drive. The drive was connected to the Mac, but the user claims they never opened any files from it. Which artifact would provide evidence of file access from the external drive?

The file system event logs (e.g., from the unified logging system) showing file open operations on the external drive.

The system log showing the drive's mount event.

The IORegistry data for the external drive.

The Spotlight index for the external drive.

During an investigation, an examiner needs to determine which applications a user launched on a specific day and correlate that with files that were accessed. Which set of artifacts would be most useful for this correlation?

The unified log and the user's bash history

The APFS snapshots and the system's configuration profiles

The user's login items and the system's sleep/wake logs

The Spotlight index and the application's recent documents list

GIAC iOS and macOS Examiner

Domain 2Objective 1

Apple File System Artifacts GIME Practice Questions (Page 5)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

Questions 21–25

21application · medium
A forensic examiner is investigating a macOS workstation used by a contractor who was terminated two weeks ago. The examiner needs to determine whether the contractor copied sensitive design files to a USB drive before leaving. The contractor had administrative rights and was known to use Time Machine. Which combination of artifacts would provide the most reliable evidence of the data transfer to the USB drive?
Select an answer first
22foundation · easy
Which Spotlight-related file stores the actual search index data on a macOS system?
Select an answer first
23foundation · easy
An analyst is investigating a file that was deleted from an APFS volume. Which artifact would most likely retain evidence of the file's prior existence and metadata?
Select an answer first
24application · medium
A forensic examiner needs to determine if a user accessed files from a specific external drive. The drive was connected to the Mac, but the user claims they never opened any files from it. Which artifact would provide evidence of file access from the external drive?
Select an answer first
25application · medium
During an investigation, an examiner needs to determine which applications a user launched on a specific day and correlate that with files that were accessed. Which set of artifacts would be most useful for this correlation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple File System Artifacts GIME Practice Questions (Page 5)

Questions 21–25

Which Spotlight-related file stores the actual search index data on a macOS system?

An analyst is investigating a file that was deleted from an APFS volume. Which artifact would most likely retain evidence of the file's prior existence and metadata?

A forensic examiner needs to determine if a user accessed files from a specific external drive. The drive was connected to the Mac, but the user claims they never opened any files from it. Which artifact would provide evidence of file access from the external drive?

During an investigation, an examiner needs to determine which applications a user launched on a specific day and correlate that with files that were accessed. Which set of artifacts would be most useful for this correlation?

Keep studying — Forensic Analysis and Artifacts