When preparing a forensic report on user behavior, which of the following formats is most effective for communicating a chronological pattern of activity?

A list of all installed applications

A timeline chart with timestamps and corresponding activities

An examiner is reconstructing a user's activities on a macOS device. The user's browser history shows visits to a job-search website at 2 AM, but the application usage database shows no activity for the browser at that time. Which conclusion is most defensible?

The application usage database is corrupted

The user was using a different browser

The browser history is fabricated

The browser may have been used in a private/incognito mode, or the application usage database may not record background tabs

An examiner is investigating an iPhone user's daily commute. Which combination of artifacts would best reconstruct the commute route and timing?

App usage database, Safari history, and keyboard dictionary

Notification logs, battery usage, and screen time reports

Significant locations database, motion activity data, and Wi-Fi/cell tower logs

iMessage attachments, call logs, and voicemail transcripts

An examiner is analyzing a macOS system where the user is suspected of working late at night. The user denies any activity after 11 PM. Which combination of system artifacts would most reliably establish a pattern of late-night usage?

Unified log entries, application usage database, and sleep/wake logs

File system timestamps, trash database, and volume metadata

Notification center logs, clipboard history, and network connections

Browser history, email metadata, and screenshot files

A forensic examiner is analyzing a macOS device seized from a suspect. The examiner needs to determine when the user typically started work each day over the past month. Which combination of system artifacts would provide the most reliable evidence of daily login and first user activity?

Spotlight index metadata and the `~/Library/Preferences/com.apple.loginitems.plist` file

The `~/Library/Logs/DiagnosticReports` folder and the `~/Library/Preferences/com.apple.TimeMachine.plist` file

The `~/Library/Application Support/com.apple.sharedfilelist` folder and the `~/Library/Preferences/com.apple.recentitems.plist` file

User login records from `/var/log/system.log` and the `last` command output

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 2)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 6–10

6foundation · easy
When preparing a forensic report on user behavior, which of the following formats is most effective for communicating a chronological pattern of activity?
Select an answer first
7expert · hard
An examiner is reconstructing a user's activities on a macOS device. The user's browser history shows visits to a job-search website at 2 AM, but the application usage database shows no activity for the browser at that time. Which conclusion is most defensible?
Select an answer first
8application · medium
An examiner is investigating an iPhone user's daily commute. Which combination of artifacts would best reconstruct the commute route and timing?
Select an answer first
9application · medium
An examiner is analyzing a macOS system where the user is suspected of working late at night. The user denies any activity after 11 PM. Which combination of system artifacts would most reliably establish a pattern of late-night usage?
Select an answer first
10application · medium
A forensic examiner is analyzing a macOS device seized from a suspect. The examiner needs to determine when the user typically started work each day over the past month. Which combination of system artifacts would provide the most reliable evidence of daily login and first user activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.