An examiner is analyzing a Mac where a user has been editing a document in Pages. The Version History shows several versions, but the examiner needs to determine whether a specific version was created locally or synced from another device. Which approach would be most reliable?

Check the file's extended attribute 'com.apple.icloud.origin'.

Compare the version's timestamp with the Mac's local login times.

Examine the iCloud sync logs for a download event that matches the version's timestamp.

Use the 'Get Info' window to see the 'Where from' field.

A forensic examiner has two versions of a Microsoft Word document from a suspect's Mac: one from the local Trash and one from an iCloud Drive backup. The examiner needs to determine whether the content differs and, if so, which version is newer. Which method is most reliable?

Compare the file sizes and the 'Date Modified' metadata from both files.

Check the iCloud sync log to see which file was uploaded last.

Hash both files and compare the hashes; if they differ, use the file's internal document metadata (e.g., 'Modified' field) to determine which is newer.

Open both files in Word and visually compare the text.

An examiner is comparing two versions of a PDF file recovered from a Mac. The examiner needs to determine if any pages were added or removed. Which approach is most efficient?

Use a PDF comparison tool that analyzes page count and content.

Manually open both PDFs and visually compare each page.

Compare the file sizes of both PDFs.

Examine the PDF metadata for a version number.

A forensic examiner is investigating a case where a user allegedly edited a document on their iPhone while in airplane mode, then later synced it to iCloud. The examiner has the iPhone's full filesystem image and the Mac's iCloud Drive logs. Which combination of evidence would best confirm that the edit was made on the iPhone and then uploaded?

The iPhone's Wi-Fi connection logs and the document's file size.

The Mac's iCloud Drive sync log and the document's version history in the Mac's Version History.

The document's local modification timestamp on the iPhone and the CloudKit upload log timestamp on the iPhone.

The document's creation date on the iPhone and the iCloud Drive server metadata.

An examiner is investigating a Mac that syncs a folder with iCloud Drive. The examiner suspects that a file was deleted on the Mac and then re-downloaded from iCloud. Which forensic artifact would provide the clearest evidence of this sequence?

The file's creation date being earlier than its modification date.

The iCloud sync log entries showing a delete operation followed by a download operation for the same file.

The presence of a .icloud placeholder file in the folder.

The file's extended attribute 'com.apple.icloud.downloaded' being set to true.

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 4)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 16–20

16expert · hard
An examiner is analyzing a Mac where a user has been editing a document in Pages. The Version History shows several versions, but the examiner needs to determine whether a specific version was created locally or synced from another device. Which approach would be most reliable?
Select an answer first
17application · medium
A forensic examiner has two versions of a Microsoft Word document from a suspect's Mac: one from the local Trash and one from an iCloud Drive backup. The examiner needs to determine whether the content differs and, if so, which version is newer. Which method is most reliable?
Select an answer first
18application · medium
An examiner is comparing two versions of a PDF file recovered from a Mac. The examiner needs to determine if any pages were added or removed. Which approach is most efficient?
Select an answer first
19expert · hard
A forensic examiner is investigating a case where a user allegedly edited a document on their iPhone while in airplane mode, then later synced it to iCloud. The examiner has the iPhone's full filesystem image and the Mac's iCloud Drive logs. Which combination of evidence would best confirm that the edit was made on the iPhone and then uploaded?
Select an answer first
20application · medium
An examiner is investigating a Mac that syncs a folder with iCloud Drive. The examiner suspects that a file was deleted on the Mac and then re-downloaded from iCloud. Which forensic artifact would provide the clearest evidence of this sequence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.