A forensic examiner needs to mount an APFS image on a Mac system for analysis. The examiner wants to ensure the image is mounted read-only to avoid any changes. Which command should the examiner use?

hdiutil attach image.dmg -readonly

An analyst is examining a macOS system and finds a file named 'com.apple.suggestions.plist' that is suspected to contain user search suggestions. The analyst needs to extract the data, but the plist is binary. Which tool should the analyst use to convert it to XML for easier reading?

sed -i 's/binary/xml/' file.plist

plutil -convert xml1 file.plist

A forensic examiner has a sparseimage file that is 10 GB in size but only contains 2 GB of actual data. The examiner needs to mount the image and analyze the data. Which command should the examiner use?

hdiutil compact image.sparseimage

hdiutil convert image.sparseimage -format UDZO -o image.dmg

hdiutil resize -size 2g image.sparseimage

hdiutil attach image.sparseimage

An examiner receives a disk image file with a .sparseimage extension and needs to mount it for analysis. The examiner is concerned about the image's integrity and wants to ensure that no changes are made to the original file. Which action should the examiner take?

Use the 'file' command to identify the image type, then mount with the appropriate tool.

Rename the file to .dmg and then mount it with hdiutil.

Convert the sparse image to a raw image using dd, then mount the raw image.

Mount the sparse image using hdiutil attach with the -readonly flag.

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 1)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 1–5

1application · medium
A forensic examiner needs to mount an APFS image on a Mac system for analysis. The examiner wants to ensure the image is mounted read-only to avoid any changes. Which command should the examiner use?
Select an answer first
2foundation · easy
Which command-line tool is commonly used on macOS to mount a DMG file for forensic analysis?
Select an answer first
3expert · medium
An analyst is examining a macOS system and finds a file named 'com.apple.suggestions.plist' that is suspected to contain user search suggestions. The analyst needs to extract the data, but the plist is binary. Which tool should the analyst use to convert it to XML for easier reading?
Select an answer first
4application · medium
A forensic examiner has a sparseimage file that is 10 GB in size but only contains 2 GB of actual data. The examiner needs to mount the image and analyze the data. Which command should the examiner use?
Select an answer first
5application · medium
An examiner receives a disk image file with a .sparseimage extension and needs to mount it for analysis. The examiner is concerned about the image's integrity and wants to ensure that no changes are made to the original file. Which action should the examiner take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.