Log Analysis and Timeline Creation GIME Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During an investigation, you have three log entries: (1) A macOS unified log entry at 10:00:00.123 with process PID 456, message 'Failed to authenticate user admin'; (2) An iOS device log entry at 10:00:02.456 showing a successful unlock with user 'admin'; (3) A network firewall log entry at 10:00:01.000 showing a connection from the iOS device to an external server. The timestamps are all in the same timezone. You need to create a timeline. What is the most accurate sequence?

   • A2 → 1 → 3
   • B3 → 1 → 2
   • C1 → 3 → 2
   • D1 → 2 → 3
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic examiner is building a timeline from a macOS system. The examiner has unified log entries, a plist file showing a login item, and a SQLite database from a web browser. The unified log shows a user login at 09:00:00, the plist shows the login item launching at 09:00:05, and the browser database shows a website visit at 09:00:10. However, the examiner notices that the login item's timestamp is recorded in a different timezone than the unified log. What is the most appropriate action to ensure timeline accuracy?

   • ASort the events using the local timezone of the examiner's workstation.
   • BIgnore the timezone difference and sort by the raw timestamp values.
   • CConvert all timestamps to UTC before sorting, and document the timezone conversion.
   • DUse the browser database's timestamp as the reference and adjust the other logs to match it.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You have created a timeline from macOS and iOS logs. You notice that an event on the iOS device appears to occur before the device was powered on according to the powerlog. What should you do?

   • AAssume the powerlog is incorrect
   • BRemove the event from the timeline
   • CCheck if the event timestamp is in a different timezone
   • DAdjust the powerlog timestamps to match the event
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An analyst has log entries from the macOS unified log and a third-party application log. Which approach is most effective for correlating these entries?

   • AMatch entries by log level only
   • BMatch entries by user ID only
   • CMatch entries by file size
   • DMatch entries by process ID and timestamp
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An examiner is creating a timeline from an iOS device's unified log and a third-party app's SQLite database. The unified log shows the device was locked at 22:00 and unlocked at 22:15. The database shows a message sent at 22:10. The examiner needs to determine if the message was sent while the device was locked. What is the most appropriate conclusion?

   • AThe message was sent after the device was unlocked because the database timestamp is unreliable.
   • BThe message could not have been sent while the device was locked because iOS prevents all background activity.
   • CThe timeline is inconsistent because a message cannot be sent while the device is locked.
   • DThe message was likely sent while the device was locked, possibly via a background process or notification action.
   Reveal Solution Discussion Select an answer first