A forensic examiner receives an E01 evidence file from a Mac system and needs to analyze it on a Windows workstation. The examiner wants to mount the image to view the file system. Which approach is most appropriate?

Convert the E01 to a raw image using dd, then mount the raw image.

Use a forensic tool that supports E01 mounting, such as FTK Imager or Arsenal Image Mounter.

Use macOS's diskutil to mount the E01 file.

Rename the file to .dmg and use hdiutil to mount it.

An analyst is examining a macOS system and finds a file named 'com.apple.finder.plist'. The analyst wants to determine the user's Finder preferences, such as show hidden files. Which approach is best?

Open the plist in a text editor and search for 'hidden'.

Use the 'defaults read' command to read the plist preferences.

Use the 'strings' command to extract readable text from the plist.

Query the plist as a SQLite database using SQL.

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 4)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 16–20

16application · medium
An examiner is analyzing a macOS system and finds a file named 'disk.dmg' that is suspected to contain a HFS+ file system. The examiner needs to mount the DMG to view the file system. Which tool is most appropriate?
Select an answer first
17application · medium
A forensic examiner receives an E01 evidence file from a Mac system and needs to analyze it on a Windows workstation. The examiner wants to mount the image to view the file system. Which approach is most appropriate?
Select an answer first
18expert · medium
An examiner is analyzing a macOS system and needs to determine which files were accessed during a specific time period. Which data type is most likely to contain this information?
Select an answer first
19application · medium
An analyst is examining a macOS system and finds a file named 'com.apple.finder.plist'. The analyst wants to determine the user's Finder preferences, such as show hidden files. Which approach is best?
Select an answer first
20application · medium
A forensic analyst is examining an APFS volume and needs to find deleted files. Which APFS feature is most relevant to this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Introduction to Disk and File Systems GIME Practice Questions (Page 4)

Questions 16–20

An examiner is analyzing a macOS system and finds a file named 'disk.dmg' that is suspected to contain a HFS+ file system. The examiner needs to mount the DMG to view the file system. Which tool is most appropriate?

A forensic examiner receives an E01 evidence file from a Mac system and needs to analyze it on a Windows workstation. The examiner wants to mount the image to view the file system. Which approach is most appropriate?

An examiner is analyzing a macOS system and needs to determine which files were accessed during a specific time period. Which data type is most likely to contain this information?

An analyst is examining a macOS system and finds a file named 'com.apple.finder.plist'. The analyst wants to determine the user's Finder preferences, such as show hidden files. Which approach is best?

A forensic analyst is examining an APFS volume and needs to find deleted files. Which APFS feature is most relevant to this task?

Keep studying — Apple Operating System Fundamentals