Pattern of Life GIME Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An examiner must present a pattern-of-life analysis to a jury. Which approach best communicates the findings while maintaining forensic integrity?

   • AUse a single chart that combines all data types into one visual
   • BPresent raw log excerpts in chronological order
   • CUse visual timelines with clear labels and cite the underlying artifacts for each data point
   • DProvide a summary of conclusions without detailed artifact references
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key output of behavioral pattern analysis in a forensic investigation?

   • AA summary of the user's typical daily schedule
   • BA network packet capture
   • CA hash of the device's storage
   • DA list of all files on the system
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An examiner is analyzing an iOS device and wants to reconstruct the user's route to work. Which combination of artifacts would provide the most reliable evidence of the user's movements?

   • AThe Wi-Fi logs and the Bluetooth logs
   • BThe call logs and the messages database
   • CThe Safari history and the app usage data
   • DThe location cache (`/private/var/mobile/Library/Caches/locationd/`) and the knowledgeC database
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic examiner is analyzing a macOS device and needs to determine the user's sleep/wake patterns. The examiner has access to the device's power management logs and the user's application usage data. Which approach would best reconstruct the user's typical bedtime and wake-up time?

   • AReview the user's calendar and reminders to infer their sleep schedule
   • BAnalyze only the application usage data to identify gaps in usage
   • CAnalyze only the power management logs to identify when the device entered sleep mode
   • DCorrelate the timestamps from the power management logs with the last application usage event before sleep and the first after wake
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic examiner is analyzing a macOS device. The user claims they never used a particular messaging app, but the examiner finds the app's container folder with recent modification times. However, the unified log shows no direct launches of the app. Which conclusion is most defensible?

   • AThe device was compromised, and the app was installed by malware
   • BThe app may have been used indirectly via a companion process or widget, so the examiner should correlate with network connections and notification logs
   • CThe user definitely used the app because the container was modified
   • DThe app was not used because there are no launch logs
   Reveal Solution Discussion Select an answer first