An examiner needs to create a forensic image of a Mac's internal SSD. The examiner wants to preserve the exact bit-for-bit copy and also capture the APFS container metadata. Which imaging method is most appropriate?

Use `asr` to create a sparse image of the disk

Use `hdiutil create` to create a compressed DMG of the disk

Use `dd` to create a raw image of the entire disk

Use `fsck_apfs` to create a filesystem-level image

An analyst is examining a macOS system and finds a file named 'com.apple.mail.plist' in a user's Preferences folder. The analyst needs to determine the user's email account settings. Which data type and analysis approach is most appropriate?

Examine the file's HFS+ extended attributes for email settings.

Open the file in a text editor to read the XML content.

Parse the plist using a plist parser to extract the email account settings.

Query the file as a SQLite database using SQL commands.

A forensic analyst has a sparseimage file that was created during a live acquisition. The analyst needs to mount it read-only to avoid altering the evidence. Which command should the analyst use?

hdiutil convert -format UDRO image.sparseimage -o image.dmg

hdiutil attach -readonly image.sparseimage

hdiutil mount -readonly image.sparseimage

hdiutil attach -noverify image.sparseimage

A forensic analyst is examining a macOS system and finds a file named 'messages.db' in a user's Library folder. The analyst needs to extract chat messages and timestamps. Which data type and tool is most appropriate?

Use a SQLite browser to query the database and extract message data.

Examine the file's HFS+ journal to recover deleted messages.

Open the file in a hex editor to manually read the messages.

Parse the file as a plist using a plist parser.

An examiner is analyzing a macOS system and needs to determine which applications have been launched recently. Which data type is most likely to contain this information?

A SQLite database in the user's Library/Application Support folder

A plist file in the user's Library/Preferences folder

A journal file in the APFS container

A DMG file in the user's Downloads folder

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 2)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 6–10

6application · medium
An examiner needs to create a forensic image of a Mac's internal SSD. The examiner wants to preserve the exact bit-for-bit copy and also capture the APFS container metadata. Which imaging method is most appropriate?
Select an answer first
7expert · medium
An analyst is examining a macOS system and finds a file named 'com.apple.mail.plist' in a user's Preferences folder. The analyst needs to determine the user's email account settings. Which data type and analysis approach is most appropriate?
Select an answer first
8application · medium
A forensic analyst has a sparseimage file that was created during a live acquisition. The analyst needs to mount it read-only to avoid altering the evidence. Which command should the analyst use?
Select an answer first
9application · medium
A forensic analyst is examining a macOS system and finds a file named 'messages.db' in a user's Library folder. The analyst needs to extract chat messages and timestamps. Which data type and tool is most appropriate?
Select an answer first
10application · medium
An examiner is analyzing a macOS system and needs to determine which applications have been launched recently. Which data type is most likely to contain this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.