A forensic examiner receives an E01 image of a Mac's hard drive. The examiner needs to analyze the APFS container inside the image. Which tool is specifically designed to handle E01 images and allow access to the APFS filesystem?

The Sleuth Kit (TSK) with ewfmount

During a macOS forensic examination, an analyst finds a file named 'com.example.app.plist' in a user's Preferences folder. The analyst needs to determine the application's last run date and user-specific settings. Which data type and analysis approach is most appropriate?

Parse the plist as a binary property list using a plist parser to extract key-value pairs.

Examine the file's HFS+ extended attributes for the last run date.

Open the plist in a text editor to read the XML content directly.

Query the file as a SQLite database using SQL commands.

A forensic examiner has an APFS image of a Mac system and needs to mount it on a Windows workstation for analysis. The examiner wants to preserve the original image and avoid any writes. Which approach is most appropriate?

Convert the APFS image to NTFS using a conversion tool, then mount it.

Use macOS's diskutil to mount the image on the Windows workstation via a network share.

Use a Windows forensic tool that supports APFS, such as Paragon APFS or APFS for Windows, to mount the image read-only.

Use the 'mount' command with the -t apfs option on the image file.

An examiner has a DMG image that is encrypted and the examiner has the passphrase. The examiner needs to mount the image and also preserve the original image file's modification time. Which approach should the examiner take?

Use hdiutil attach with -readonly to prevent any changes

Use hdiutil verify before mounting to ensure integrity

Mount the DMG with hdiutil attach and then use `touch -r` to restore the original modification time

Copy the DMG to a new file and mount the copy

GIAC iOS and macOS Examiner

Domain 1Objective 2

Introduction to Disk and File Systems GIME Practice Questions (Page 6)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

3concepts

Questions 26–30

26application · medium
An examiner needs to mount a DMG file that contains a macOS installer. The examiner wants to verify the integrity of the DMG before mounting. Which command-line tool should the examiner use?
Select an answer first
27application · medium
A forensic examiner receives an E01 image of a Mac's hard drive. The examiner needs to analyze the APFS container inside the image. Which tool is specifically designed to handle E01 images and allow access to the APFS filesystem?
Select an answer first
28application · medium
During a macOS forensic examination, an analyst finds a file named 'com.example.app.plist' in a user's Preferences folder. The analyst needs to determine the application's last run date and user-specific settings. Which data type and analysis approach is most appropriate?
Select an answer first
29expert · hard
A forensic examiner has an APFS image of a Mac system and needs to mount it on a Windows workstation for analysis. The examiner wants to preserve the original image and avoid any writes. Which approach is most appropriate?
Select an answer first
30expert · medium
An examiner has a DMG image that is encrypted and the examiner has the passphrase. The examiner needs to mount the image and also preserve the original image file's modification time. Which approach should the examiner take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.