An examiner is investigating a macOS system where a user allegedly accessed a sensitive file. The examiner has unified logs showing a process reading the file, a plist showing a login item that launches the process, and a SQLite database from a file manager app showing the file was opened. The timestamps are: unified log 14:00:00, plist 13:59:55, and database 14:00:05. What is the most likely sequence of events?

Login item launched the process, which read the file, and the file manager recorded the open.

The database update caused the process to read the file, which then launched the login item.

The file manager opened the file, which triggered the login item, which launched the process.

The process read the file, which caused the login item to launch, which then updated the database.

A forensic examiner has created a timeline from macOS unified logs and a third-party application's SQLite database. The timeline shows a user login at 08:00, followed by an app launch at 08:05, and a file download at 08:10. However, the examiner notices that the unified log shows a process crash at 08:04, which is not reflected in the timeline. What is the most appropriate action?

Update the timeline to include the crash event and note the potential impact on subsequent events.

Remove the app launch from the timeline because it may have been affected by the crash.

Ignore the crash because it is not directly related to the user's activities.

Assume the crash is a system artifact and not relevant to the investigation.

While building an event timeline, an analyst notices a 30-minute gap between two related events. What should the analyst do?

Flag the gap as an anomaly and investigate for missing logs

Ignore the gap and continue the timeline

Assume the device was powered off

Delete the earlier event to make the timeline consistent

You are examining a macOS system suspected of unauthorized access. The user claims they were not using the computer at 2:00 AM. You need to determine if any user logged in at that time. Which log source and method would provide the most direct evidence of a local login event?

Run `log show --style syslog --predicate 'process == "loginwindow"' --start "2024-01-15 01:55:00" --end "2024-01-15 02:05:00"`

Check the `last` command output to see if a reboot occurred at that time

Query the unified log using `log show --predicate 'eventMessage CONTAINS "authentication"' --start "2024-01-15 01:55:00" --end "2024-01-15 02:05:00"`

Examine the `/var/log/system.log` file for entries containing 'loginwindow' around 2:00 AM

What is the primary purpose of validating a forensic timeline against the original log data?

To ensure the timeline accurately reflects the source logs

To reduce the number of events in the timeline

To make the timeline easier to read

GIAC iOS and macOS Examiner

Domain 2Objective 2

Log Analysis and Timeline Creation GIME Practice Questions (Page 1)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 1–5

1application · medium
An examiner is investigating a macOS system where a user allegedly accessed a sensitive file. The examiner has unified logs showing a process reading the file, a plist showing a login item that launches the process, and a SQLite database from a file manager app showing the file was opened. The timestamps are: unified log 14:00:00, plist 13:59:55, and database 14:00:05. What is the most likely sequence of events?
Select an answer first
2application · medium
A forensic examiner has created a timeline from macOS unified logs and a third-party application's SQLite database. The timeline shows a user login at 08:00, followed by an app launch at 08:05, and a file download at 08:10. However, the examiner notices that the unified log shows a process crash at 08:04, which is not reflected in the timeline. What is the most appropriate action?
Select an answer first
3foundation · easy
While building an event timeline, an analyst notices a 30-minute gap between two related events. What should the analyst do?
Select an answer first
4application · medium
You are examining a macOS system suspected of unauthorized access. The user claims they were not using the computer at 2:00 AM. You need to determine if any user logged in at that time. Which log source and method would provide the most direct evidence of a local login event?
Select an answer first
5foundation · easy
What is the primary purpose of validating a forensic timeline against the original log data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Log Analysis and Timeline Creation GIME Practice Questions (Page 1)

Questions 1–5

While building an event timeline, an analyst notices a 30-minute gap between two related events. What should the analyst do?

You are examining a macOS system suspected of unauthorized access. The user claims they were not using the computer at 2:00 AM. You need to determine if any user logged in at that time. Which log source and method would provide the most direct evidence of a local login event?

What is the primary purpose of validating a forensic timeline against the original log data?

Keep studying — Forensic Analysis and Artifacts