An examiner has a DMG that was created with a read-only filesystem. The examiner needs to add a file to the image for testing purposes. Which approach should the examiner take?

Convert the DMG to a read-write format using hdiutil convert -format UDRW

Use `asr` to restore the DMG to a writable volume

Mount the DMG with hdiutil attach and then copy the file

Use hdiutil resize to increase the size and then mount

A forensic analyst has an APFS image of a Mac system and needs to mount it on a Linux forensic workstation to examine the file system. The analyst wants to preserve the original image and avoid any writes to it. Which method is most appropriate?

Use a Linux kernel module that supports APFS to mount the image read-only.

Use macOS's diskutil to mount the image on the Linux workstation.

Convert the APFS image to HFS+ using a conversion tool, then mount it.

Mount the image with the 'mount' command using the ext4 file system type.

An examiner receives a forensic image of a Mac that was captured by a third-party tool. The image file has a .dmg extension and the examiner needs to verify its integrity before mounting. Which approach should the examiner take?

Run `hdiutil verify` on the DMG to check its internal checksums.

Mount the DMG directly and compare the file listing to the original acquisition notes.

Convert the DMG to E01 using ewfacquire and then verify the E01.

Re-acquire the source drive to ensure the image is valid.

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 5)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 21–25

21foundation · easy
A forensic analyst receives an evidence file that is a read-only, compressed, and optionally encrypted container commonly used by forensic tools to preserve an exact copy of a disk. Which disk image format is this?
Select an answer first
22expert · medium
An examiner has a DMG that was created with a read-only filesystem. The examiner needs to add a file to the image for testing purposes. Which approach should the examiner take?
Select an answer first
23foundation · easy
Which Apple system data type is specifically used to record changes to a file system to ensure consistency after an unexpected shutdown?
Select an answer first
24application · medium
A forensic analyst has an APFS image of a Mac system and needs to mount it on a Linux forensic workstation to examine the file system. The analyst wants to preserve the original image and avoid any writes to it. Which method is most appropriate?
Select an answer first
25application · medium
An examiner receives a forensic image of a Mac that was captured by a third-party tool. The image file has a .dmg extension and the examiner needs to verify its integrity before mounting. Which approach should the examiner take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Introduction to Disk and File Systems GIME Practice Questions (Page 5)

Questions 21–25

A forensic analyst receives an evidence file that is a read-only, compressed, and optionally encrypted container commonly used by forensic tools to preserve an exact copy of a disk. Which disk image format is this?

An examiner has a DMG that was created with a read-only filesystem. The examiner needs to add a file to the image for testing purposes. Which approach should the examiner take?

Which Apple system data type is specifically used to record changes to a file system to ensure consistency after an unexpected shutdown?

A forensic analyst has an APFS image of a Mac system and needs to mount it on a Linux forensic workstation to examine the file system. The analyst wants to preserve the original image and avoid any writes to it. Which method is most appropriate?

An examiner receives a forensic image of a Mac that was captured by a third-party tool. The image file has a .dmg extension and the examiner needs to verify its integrity before mounting. Which approach should the examiner take?

Keep studying — Apple Operating System Fundamentals