A forensic examiner receives a USB drive containing a single file labeled 'suspect.dmg' and is asked to analyze its contents without altering the original. The examiner needs to access the file system inside the DMG for read-only analysis. Which approach best preserves the integrity of the original evidence while allowing the examiner to work with the data?

Use a third-party tool to extract the DMG's raw image data and analyze it with a hex editor.

Use hdiutil convert to convert the DMG to a read-only UDIF format before mounting.

Copy the DMG to a forensic workstation and mount it with the 'open' command in Finder.

Mount the DMG directly using macOS's built-in hdiutil attach command with the -readonly flag.

During a macOS forensic examination, an analyst encounters a file with no extension that is suspected to be a SQLite database. The analyst needs to confirm the file type before proceeding. Which tool is most appropriate?

Rename the file to .db and try to open it with a SQLite browser.

Use the 'strings' command to extract readable text and look for 'SQLite'.

Use the 'file' command to identify the file type based on magic bytes.

Open the file in a text editor to look for SQL statements.

An examiner has an APFS volume that is mounted from a forensic image. The examiner needs to recover a deleted file that was present in a snapshot. Which command should the examiner use to mount the snapshot?

hdiutil attach -snapshot snapshot_name /dev/diskX

mount_apfs -s snapshot_name /dev/diskX /mnt

diskutil apfs mountSnapshot /dev/diskX -s snapshot_name

fsck_apfs -s snapshot_name /dev/diskX

An examiner is analyzing a macOS system and needs to determine which files were recently modified. Which data type is most likely to contain this information?

The filesystem's metadata (e.g., stat command)

An examiner has a DMG that is corrupted and cannot be mounted. The examiner needs to recover as much data as possible. Which tool should the examiner use?

Use a data recovery tool like PhotoRec

Use `fsck_hfs` to repair the DMG

hdiutil verify to check the integrity

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 3)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 11–15

11application · medium
A forensic examiner receives a USB drive containing a single file labeled 'suspect.dmg' and is asked to analyze its contents without altering the original. The examiner needs to access the file system inside the DMG for read-only analysis. Which approach best preserves the integrity of the original evidence while allowing the examiner to work with the data?
Select an answer first
12application · medium
During a macOS forensic examination, an analyst encounters a file with no extension that is suspected to be a SQLite database. The analyst needs to confirm the file type before proceeding. Which tool is most appropriate?
Select an answer first
13expert · medium
An examiner has an APFS volume that is mounted from a forensic image. The examiner needs to recover a deleted file that was present in a snapshot. Which command should the examiner use to mount the snapshot?
Select an answer first
14expert · medium
An examiner is analyzing a macOS system and needs to determine which files were recently modified. Which data type is most likely to contain this information?
Select an answer first
15expert · medium
An examiner has a DMG that is corrupted and cannot be mounted. The examiner needs to recover as much data as possible. Which tool should the examiner use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.