An examiner must present pattern-of-life findings in a legal report. The data includes conflicting timestamps from different artifacts. Which approach best maintains forensic integrity?

Use only the artifact with the most timestamps and ignore others

Present the conflicting timestamps transparently, explain the discrepancies, and provide a reconciled timeline with confidence levels

Select the timestamps that support the most likely narrative and omit conflicting data

Average the conflicting timestamps to create a single timeline

An examiner is analyzing an iPhone to determine if a user typically visits a specific coffee shop. The significant locations database shows the location, but the user's calendar has no matching events. Which conclusion is most defensible?

The user may visit the coffee shop without scheduling it, so the significant locations database is more reliable for location habits

The user visited the coffee shop only once, and the significant locations database recorded it as a frequent location

The user does not visit the coffee shop because the calendar has no events

The significant locations database is inaccurate because it does not match the calendar

An examiner is analyzing an iPhone to infer whether the user typically exercises in the morning. Which artifacts would provide the most direct evidence of physical activity?

Motion and fitness data (pedometer, workout routes)

Location data from significant locations

App usage database showing health app launches

Calendar events labeled 'workout'

An examiner is preparing a pattern-of-life report for a case involving a user who works in a sensitive facility. The report must show the user's daily routine without revealing unnecessary personal details. Which approach best balances clarity and privacy?

Present aggregated patterns (e.g., 'user typically logs in between 8:30 and 9:00 AM') rather than specific timestamps for every day

Omit all location data to protect privacy

Include every timestamp and location to be thorough

Use vague descriptions like 'morning' and 'afternoon' without specific times

An examiner is preparing a forensic report for a court case involving a user's location history. The examiner has data from the iOS location cache, Wi-Fi logs, and app usage. The report must be understandable to a jury while maintaining technical accuracy. Which presentation approach best balances clarity and accuracy?

A map with plotted location points and a timeline of visits, with a technical appendix containing raw data

A verbal summary of the examiner's conclusions without visual aids

A detailed table of all location points with timestamps and source file paths

A heat map of location density without timestamps

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 7)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 31–35

31expert · hard
An examiner must present pattern-of-life findings in a legal report. The data includes conflicting timestamps from different artifacts. Which approach best maintains forensic integrity?
Select an answer first
32expert · hard
An examiner is analyzing an iPhone to determine if a user typically visits a specific coffee shop. The significant locations database shows the location, but the user's calendar has no matching events. Which conclusion is most defensible?
Select an answer first
33application · medium
An examiner is analyzing an iPhone to infer whether the user typically exercises in the morning. Which artifacts would provide the most direct evidence of physical activity?
Select an answer first
34expert · hard
An examiner is preparing a pattern-of-life report for a case involving a user who works in a sensitive facility. The report must show the user's daily routine without revealing unnecessary personal details. Which approach best balances clarity and privacy?
Select an answer first
35expert · hard
An examiner is preparing a forensic report for a court case involving a user's location history. The examiner has data from the iOS location cache, Wi-Fi logs, and app usage. The report must be understandable to a jury while maintaining technical accuracy. Which presentation approach best balances clarity and accuracy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.