Introduction to Apple Operating Systems GIME Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic examiner is asked to analyze a macOS system that was used to upload files to a cloud storage service. The examiner needs to determine which files were uploaded and when. The system has been powered off for a week. Which data source is most likely to contain the relevant evidence?

   • AThe browser's download history.
   • BThe system's unified log.
   • CThe system's sleep image.
   • DThe cloud storage client's local database.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An examiner is investigating a macOS system where the user may have deleted incriminating files. The examiner needs to recover deleted files and analyze the filesystem metadata to determine when the files were created and last accessed. Which type of data acquisition is most appropriate for this task?

   • AA copy of the system's Time Machine backup.
   • BA memory dump of the running system.
   • CA logical collection of all user files from the home directory.
   • DA full forensic image of the internal SSD, including unallocated space.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An examiner is investigating a macOS system where the user is suspected of using encrypted messaging apps. The examiner needs to determine if any messages are present in memory and also analyze the filesystem for artifacts left by the apps. The system is running. Which approach is most appropriate?

   • APerform a logical collection of the app's data container only.
   • BCapture memory first, then create a full forensic image of the SSD.
   • CUse the app's cloud backup to retrieve messages.
   • DCreate a full forensic image of the SSD first, then capture memory.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic examiner is called to image a MacBook Pro that was used by an employee suspected of data exfiltration. The laptop is powered on and the user is logged in. The examiner needs to preserve the most volatile data first while also obtaining a full copy of the internal SSD for later analysis. Which sequence of actions best meets these requirements?

   • ACapture RAM using a kernel module, then shut down the system and create a forensic image of the SSD using a write-blocker.
   • BUse the built-in Time Machine backup as the primary evidence source and skip memory acquisition.
   • CCreate a forensic image of the SSD first, then capture RAM from the running system afterward.
   • DPerform a logical collection of the user's Documents and Downloads folders, then power off the system and image the SSD.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic examiner is investigating a macOS system where the user is suspected of using a virtual machine to hide activities. The examiner needs to determine if a virtual machine was used and what activities occurred inside it. Which data sources would be most relevant?

   • ASystem logs only.
   • BLogical collection of the user's Downloads folder.
   • CNetwork logs from the corporate proxy.
   • DFull disk image and memory dump of the host system.
   Reveal Solution Discussion Select an answer first