A forensic examiner is investigating a macOS device and needs to determine when the user last connected a specific external USB drive. Which system artifact would provide the most reliable evidence of this event?

The `~/Library/Preferences/com.apple.recentitems.plist` file

The `~/Library/Preferences/com.apple.loginitems.plist` file

The `~/Library/Application Support/com.apple.sharedfilelist` folder

The system log (`/var/log/system.log`) and the `ioreg` command output

An examiner is analyzing a macOS device to determine if a user typically works on weekends. Which artifact would provide the most reliable evidence of weekend work patterns?

Login/logout events and application usage timestamps across multiple weekends

A forensic analyst is examining a macOS device and wants to determine if the user typically works on weekends. The analyst has access to the user's file access logs, application usage data, and email metadata. Which approach would provide the most reliable inference?

Review the user's calendar to see if meetings were scheduled on weekends

Analyze only the application usage data to see if work-related apps were used on weekends

Correlate file access timestamps with application usage data to identify patterns of activity on weekends versus weekdays

Analyze only the email metadata to see if emails were sent on weekends

An examiner is reconstructing a user's activities on an iPhone. Which correlation would best establish that the user was at a specific location at a specific time?

Correlating app usage with Wi-Fi network names

Correlating keyboard dictionary entries with calendar events

Correlating call logs with cell tower IDs

Correlating a photo's GPS metadata with the significant locations database

Which iOS system artifact is most likely to contain a record of the user's frequently visited locations, which can be used to infer daily routines?

The significant locations database

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 1)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 1–5

1application · medium
A forensic examiner is investigating a macOS device and needs to determine when the user last connected a specific external USB drive. Which system artifact would provide the most reliable evidence of this event?
Select an answer first
2application · medium
An examiner is analyzing a macOS device to determine if a user typically works on weekends. Which artifact would provide the most reliable evidence of weekend work patterns?
Select an answer first
3expert · hard
A forensic analyst is examining a macOS device and wants to determine if the user typically works on weekends. The analyst has access to the user's file access logs, application usage data, and email metadata. Which approach would provide the most reliable inference?
Select an answer first
4application · medium
An examiner is reconstructing a user's activities on an iPhone. Which correlation would best establish that the user was at a specific location at a specific time?
Select an answer first
5foundation · easy
Which iOS system artifact is most likely to contain a record of the user's frequently visited locations, which can be used to infer daily routines?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.