An examiner is preparing a report for a legal team about a user's app usage patterns. The examiner has data from the iOS knowledgeC database and app usage logs. Which presentation method would best communicate the user's most frequently used apps and times of use?

A timeline of individual app launches with timestamps

A bar chart showing app usage frequency by hour of day

A raw SQL dump of the knowledgeC database

A list of app names with total usage times

An examiner is analyzing a macOS device to infer a user's work schedule. Which set of artifacts, when correlated, would provide the most reliable evidence of daily routine?

Network connections, DNS queries, and firewall logs

Login/logout events, application usage, and file access times

System update logs, crash reports, and diagnostic reports

Screenshot timestamps, printer logs, and external device connections

An examiner is analyzing an iOS device and wants to determine if the user visited a specific location at a particular time. Which combination of artifacts would provide the most conclusive evidence?

The call logs and the messages database

The location cache and the knowledgeC database

The Wi-Fi logs and the Bluetooth logs

The Safari history and the app usage data

An examiner is investigating a macOS user who denies using a specific application. Which artifact would provide the most direct evidence of application usage?

Application usage database (e.g., knowledgeC.db)

Network connections from the application

Crash reports for the application

File system timestamps for the application bundle

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 6)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 26–30

26foundation · easy
An examiner notices that a user consistently opens the Mail app at 8:00 AM on weekdays and rarely on weekends. This observation is an example of which type of analysis?
Select an answer first
27application · medium
An examiner is preparing a report for a legal team about a user's app usage patterns. The examiner has data from the iOS knowledgeC database and app usage logs. Which presentation method would best communicate the user's most frequently used apps and times of use?
Select an answer first
28application · medium
An examiner is analyzing a macOS device to infer a user's work schedule. Which set of artifacts, when correlated, would provide the most reliable evidence of daily routine?
Select an answer first
29application · medium
An examiner is analyzing an iOS device and wants to determine if the user visited a specific location at a particular time. Which combination of artifacts would provide the most conclusive evidence?
Select an answer first
30application · medium
An examiner is investigating a macOS user who denies using a specific application. Which artifact would provide the most direct evidence of application usage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.