An examiner has two versions of a Keynote presentation: one from a Mac's local storage and one from an iCloud backup. The examiner needs to determine which version is newer. Which metadata field would be most reliable?

The file's creation date from the iCloud server.

The 'Modified' date in the file's internal metadata (e.g., from the presentation's properties).

The file system 'Date Added' attribute on the Mac.

The 'Last Opened' date from the file's metadata.

When comparing two versions of a text document, which forensic method is most effective for identifying exactly what text was added or removed?

Comparing file sizes to estimate the amount of change

Comparing file hashes (e.g., SHA-256)

Using a text comparison tool that performs a line-by-line or word-level diff

Performing a binary diff of the raw file contents

A user on macOS has been editing a text file in TextEdit. They want to recover a version from two hours ago, but the Version History only shows versions from the last 30 minutes. What is the most likely reason?

The file was opened from a network share, which does not support versioning.

The system's local snapshot (APFS) for the file was deleted because of storage pressure.

The file was saved to iCloud Drive, and local versions are pruned after 30 minutes.

TextEdit only keeps versions for the current session.

A forensic examiner is investigating a Mac and needs to identify when a document was last edited and by which user account. Which artifacts should the examiner examine?

The file's metadata (modification date) and the system's unified log for file-coordination events.

The file's ACLs and the system's sleep/wake logs.

The file's quarantine attribute and the Spotlight index.

The file's extended attributes and the user's shell history.

Which database on iOS contains metadata about files stored in iCloud Drive, such as their names, sizes, and modification dates?

CloudKit account info database (or similar)

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 5)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 21–25

21application · medium
An examiner has two versions of a Keynote presentation: one from a Mac's local storage and one from an iCloud backup. The examiner needs to determine which version is newer. Which metadata field would be most reliable?
Select an answer first
22foundation · easy
When comparing two versions of a text document, which forensic method is most effective for identifying exactly what text was added or removed?
Select an answer first
23application · medium
A user on macOS has been editing a text file in TextEdit. They want to recover a version from two hours ago, but the Version History only shows versions from the last 30 minutes. What is the most likely reason?
Select an answer first
24application · medium
A forensic examiner is investigating a Mac and needs to identify when a document was last edited and by which user account. Which artifacts should the examiner examine?
Select an answer first
25foundation · easy
Which database on iOS contains metadata about files stored in iCloud Drive, such as their names, sizes, and modification dates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.