An examiner wants to reconstruct a user's morning routine by correlating data from multiple artifacts. Which combination of artifacts would provide the most reliable chronological evidence of the user's activities?

Call history and text message database

Safari history and photo metadata only

System log, Safari history, and location database

Which of the following is a best practice when presenting system artifact findings in a forensic report?

Use technical jargon without explanation

List only the artifacts that support the conclusion

Include raw data without interpretation

Provide context and explain the significance of each artifact

During an investigation, an examiner finds a user's iPhone was used to send a message at 2:00 AM. The user claims the phone was unattended. Which additional artifact would best help verify whether the user was physically interacting with the device at that time?

Biometric unlock events from the secure enclave

An examiner is reconstructing a user's activities on an iPhone. The significant locations database shows the user at a gym every weekday morning, but the motion activity data shows no walking or running during those times. Which conclusion is most likely?

The user may be driving to the gym, and the motion data may not capture stationary activities like weightlifting

The user is not actually going to the gym; the phone is being carried by someone else

The significant locations database is inaccurate

An examiner is analyzing an iPhone and finds that the user's location services were disabled for a period. However, the user's photos still contain GPS metadata. Which conclusion is most defensible?

The photos may have been taken with location services enabled, or the GPS metadata could have been added later by another device or app

The photos were taken during the period when location services were disabled

The user disabled location services but the camera app bypassed the setting

The GPS metadata is fake and should be ignored

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 3)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 11–15

11foundation · easy
An examiner wants to reconstruct a user's morning routine by correlating data from multiple artifacts. Which combination of artifacts would provide the most reliable chronological evidence of the user's activities?
Select an answer first
12foundation · easy
Which of the following is a best practice when presenting system artifact findings in a forensic report?
Select an answer first
13application · medium
During an investigation, an examiner finds a user's iPhone was used to send a message at 2:00 AM. The user claims the phone was unattended. Which additional artifact would best help verify whether the user was physically interacting with the device at that time?
Select an answer first
14expert · hard
An examiner is reconstructing a user's activities on an iPhone. The significant locations database shows the user at a gym every weekday morning, but the motion activity data shows no walking or running during those times. Which conclusion is most likely?
Select an answer first
15expert · hard
An examiner is analyzing an iPhone and finds that the user's location services were disabled for a period. However, the user's photos still contain GPS metadata. Which conclusion is most defensible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.