Application Fundamentals GIME Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   An examiner is analyzing an iOS app that stores user-generated content. The examiner finds a file named 'store.sqlite' in the app's Library/Application Support directory. What is the most likely data structure and how should the examiner proceed?

   • AIt is a Core Data store; use a Core Data editor to view it.
   • BIt is a property list; use a plist editor.
   • CIt is a SQLite database; open it with sqlite3 and inspect the schema.
   • DIt is a JSON file; open with a text editor.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is investigating a macOS application that uses Core Data with a SQLite store. The examiner finds a .sqlite file, a -wal file, and a -shm file. The examiner needs to ensure all committed transactions are included in the main database file before copying it for analysis. What should the examiner do?

   • ACopy only the .sqlite file, as it contains all committed data.
   • BRename the -wal file to .sqlite and copy it.
   • CCopy all three files (.sqlite, -wal, -shm) together and use a SQLite tool that supports WAL mode to query the database.
   • DDelete the -wal and -shm files before copying the .sqlite file.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a forensic examination of an iOS app, the examiner locates a SQLite database file. The examiner wants to see the schema of all tables to understand the data structure. Which command should the examiner run?

   • Asqlite3 database.db SELECT * FROM sqlite_master;
   • Bsqlite3 database.db .tables
   • Csqlite3 database.db .dump
   • Dsqlite3 database.db .schema
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An examiner is analyzing a macOS app that stores data in both a property list and a SQLite database. The examiner needs to correlate data between the two files. What is the most efficient method?

   • AUse a script to parse the plist and query the SQLite database, then correlate in code.
   • BOpen both files in a text editor and manually compare.
   • CExport both to CSV and use a spreadsheet to correlate.
   • DConvert the property list to a SQLite database and then join the tables.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An examiner is analyzing a macOS application that uses Core Data. The examiner finds a file with a .sqlite extension in the app's Application Support directory. What is the most accurate interpretation of this file?

   • AIt is a property list that stores the app's preferences.
   • BIt is a Core Data store that may be SQLite-backed, but the examiner should use Core Data tools or carefully inspect the schema.
   • CIt is a standard SQLite database that can be directly queried with sqlite3.
   • DIt is a binary plist that requires conversion before analysis.
   Reveal Solution Discussion Select an answer first