An examiner is investigating a macOS system where a user is suspected of using a USB drive to transfer files and then using Spotlight to search for those files on the drive. The examiner has the system's unified log, the USB drive's APFS journal, and the system's Spotlight index. The unified log shows the USB drive was connected. The USB drive's APFS journal shows files were created on the drive. The system's Spotlight index contains metadata for files that match the names of the files on the USB drive. Which of the following is the most likely interpretation?

The Spotlight index entries are remnants of deleted files that were never copied to the USB drive.

The files were copied to the USB drive, and the Spotlight index on the system volume contains metadata from when the files were on the system before the copy, or from indexing the USB drive while it was connected.

The files were only on the USB drive and were never on the system volume, so the Spotlight index must have indexed the USB drive.

The Spotlight index entries are from the USB drive's own Spotlight index, not the system volume's.

GIAC iOS and macOS Examiner

Domain 2Objective 1

Apple File System Artifacts GIME Practice Questions (Page 6)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

Questions 26–26

26expert · hard
An examiner is investigating a macOS system where a user is suspected of using a USB drive to transfer files and then using Spotlight to search for those files on the drive. The examiner has the system's unified log, the USB drive's APFS journal, and the system's Spotlight index. The unified log shows the USB drive was connected. The USB drive's APFS journal shows files were created on the drive. The system's Spotlight index contains metadata for files that match the names of the files on the USB drive. Which of the following is the most likely interpretation?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple File System Artifacts GIME Practice Questions (Page 6)

Questions 26–26

Keep studying — Forensic Analysis and Artifacts