Where does macOS store the version history for a document that uses the Versions feature?

In a dedicated database within the application's container, such as ~/Library/Containers/.

In the file system's local snapshots, accessible via the Time Machine interface.

In a special hidden directory within the file's parent directory, managed by the file system.

In the same directory as the original file, as a series of hidden .version files.

A company is investigating a data leak. A sensitive PDF was stored in a shared iCloud Drive folder. The investigator needs to determine whether a specific user's iPhone downloaded the file to their device. Which forensic artifact would provide the most direct evidence?

The iCloud Drive 'Downloaded' flag in the file's extended attributes on the iPhone.

The user's iCloud account sign-in history from the corporate proxy logs.

The file's modification timestamp in the iCloud Drive server metadata.

The CloudKit sync log on the iPhone, which records fetch operations for the file.

A user has iCloud Drive enabled on their Mac and iPhone. They notice that a file edited on the iPhone does not appear on the Mac. Which diagnostic step would be most effective to determine whether the file was uploaded to iCloud?

Verify that the iPhone is connected to Wi-Fi.

Check the file's modification date on the iPhone.

Look at the CloudKit logs on the iPhone for an upload operation for that file.

Check the iCloud Drive status in System Settings on the Mac.

A forensic examiner is analyzing a macOS system and needs to determine how many versions of a document were created and when. Which set of artifacts should the examiner prioritize?

The file's quarantine attribute and the Spotlight index.

The file's ACLs and the system's sleep/wake logs.

The iCloud Drive sync logs and the user's browser history.

The document's version history stored in the local file system (e.g., .DocumentRevisions-V100) and the file's metadata.

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 3)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 11–15

11foundation · easy
Which metadata attribute is most reliable for determining the chronological order of document versions?
Select an answer first
12foundation · easy
Where does macOS store the version history for a document that uses the Versions feature?
Select an answer first
13application · medium
A company is investigating a data leak. A sensitive PDF was stored in a shared iCloud Drive folder. The investigator needs to determine whether a specific user's iPhone downloaded the file to their device. Which forensic artifact would provide the most direct evidence?
Select an answer first
14application · medium
A user has iCloud Drive enabled on their Mac and iPhone. They notice that a file edited on the iPhone does not appear on the Mac. Which diagnostic step would be most effective to determine whether the file was uploaded to iCloud?
Select an answer first
15application · medium
A forensic examiner is analyzing a macOS system and needs to determine how many versions of a document were created and when. Which set of artifacts should the examiner prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.