An examiner is investigating an iOS device and needs to reconstruct the user's daily routine, including when they wake up, commute, and arrive at work. The examiner has access to the knowledgeC database, location cache, and app usage data. Which approach would provide the most accurate reconstruction?

Analyze only the location cache to determine when the user left home and arrived at work

Correlate the knowledgeC activity timestamps with location cache entries to identify when the user left home and arrived at work, and use app usage data to infer activities during the commute

Analyze only the app usage data to infer when the user was using their phone

Analyze only the knowledgeC database to identify activity patterns

When correlating artifacts to establish a timeline of user activity, which of the following is the most important factor to consider?

The number of installed applications

The time zone settings of the device

The color scheme of the user interface

An examiner finds a gap in a user's activity timeline on a macOS device. The user claims they were working during that gap. Which artifact would best help determine if the device was actually in use during the gap?

File system last accessed times

Power management logs (sleep/wake events)

An examiner needs to present findings about a user's daily routine to a non-technical jury. The examiner has correlated data from multiple iOS artifacts. Which presentation method would most effectively communicate the user's behavioral pattern?

A verbal summary of the examiner's conclusions without visual aids

A series of raw database exports from the knowledgeC database and location cache

A detailed table listing every timestamp from every artifact with source file paths

A chronological timeline chart showing device activity and location changes overlaid with app usage

An examiner is analyzing a macOS device to determine if a user works from home on certain days. The user's login events show logins at 9 AM on weekdays, but the Wi-Fi logs show connection to a home network only on Tuesdays and Thursdays. Which conclusion is most defensible?

The user never works from home because Wi-Fi logs only show home network on two days

The user works from home every day because login events show logins

The Wi-Fi logs are incomplete and should be ignored

The user may work from home on Tuesdays and Thursdays, but the examiner should correlate with other artifacts like VPN logs or application usage

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 4)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 16–20

16expert · hard
An examiner is investigating an iOS device and needs to reconstruct the user's daily routine, including when they wake up, commute, and arrive at work. The examiner has access to the knowledgeC database, location cache, and app usage data. Which approach would provide the most accurate reconstruction?
Select an answer first
17foundation · easy
When correlating artifacts to establish a timeline of user activity, which of the following is the most important factor to consider?
Select an answer first
18application · medium
An examiner finds a gap in a user's activity timeline on a macOS device. The user claims they were working during that gap. Which artifact would best help determine if the device was actually in use during the gap?
Select an answer first
19application · medium
An examiner needs to present findings about a user's daily routine to a non-technical jury. The examiner has correlated data from multiple iOS artifacts. Which presentation method would most effectively communicate the user's behavioral pattern?
Select an answer first
20expert · hard
An examiner is analyzing a macOS device to determine if a user works from home on certain days. The user's login events show logins at 9 AM on weekdays, but the Wi-Fi logs show connection to a home network only on Tuesdays and Thursdays. Which conclusion is most defensible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.