An examiner is preparing a forensic report on a user's location-based habits. The examiner has data from the iOS location cache, Wi-Fi logs, and app usage. Which presentation format would best illustrate the user's frequent locations and times?

A spreadsheet listing all location points with timestamps

A list of Wi-Fi network names with connection times

A heat map overlay on a map showing location density with a timeline of visits

A bar chart of app usage by hour

An examiner is preparing a report for a corporate investigation about a user's daily activities. The examiner has data from multiple iOS and macOS artifacts. The report will be reviewed by both technical and non-technical stakeholders. Which presentation approach best serves both audiences?

A verbal presentation with no written report

A single visual summary with no technical details

A single detailed report with all raw data and technical explanations

An executive summary with visual timelines and charts, followed by a detailed technical appendix with raw data and methodology

An examiner is reconstructing a user's daily routine from an iOS device. The examiner has access to the device's knowledgeC database, location services cache, and app usage data. Which approach would best establish a chronological pattern of the user's morning activities?

Review the user's calendar and reminders to determine their planned morning schedule

Examine the device's power log to see when the device was charged overnight, then infer wake-up time

Correlate the timestamps from the knowledgeC database with location cache entries to identify when the user was at home and when they left for work

Analyze only the app usage data to determine which apps were opened first each morning

A forensic examiner is analyzing a macOS device and needs to determine if the user accessed a specific file at a particular time. The examiner has access to the file system metadata, Spotlight index, and the user's application usage data. Which combination of evidence would provide the most reliable proof of file access?

The file's creation time (crtime) and the user's login records

The application usage data showing the associated app was used and the user's web browsing history

The Spotlight index metadata showing the file was indexed and the file's modification time (mtime)

The file's access time (atime) from the file system metadata and the application usage data showing the associated app was used at that time

GIAC iOS and macOS Examiner

Domain 2Objective 3

Pattern of Life GIME Practice Questions (Page 8)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

4concepts

Questions 36–40

36application · medium
An examiner is preparing a forensic report on a user's location-based habits. The examiner has data from the iOS location cache, Wi-Fi logs, and app usage. Which presentation format would best illustrate the user's frequent locations and times?
Select an answer first
37expert · hard
An examiner is preparing a report for a corporate investigation about a user's daily activities. The examiner has data from multiple iOS and macOS artifacts. The report will be reviewed by both technical and non-technical stakeholders. Which presentation approach best serves both audiences?
Select an answer first
38application · medium
An examiner is reconstructing a user's daily routine from an iOS device. The examiner has access to the device's knowledgeC database, location services cache, and app usage data. Which approach would best establish a chronological pattern of the user's morning activities?
Select an answer first
39expert · hard
A forensic examiner is analyzing a macOS device and needs to determine if the user accessed a specific file at a particular time. The examiner has access to the file system metadata, Spotlight index, and the user's application usage data. Which combination of evidence would provide the most reliable proof of file access?
Select an answer first
40foundation · easy
During a forensic examination of a macOS system, which of the following system artifacts would most directly reveal the times a user typically logs in and out of the system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Pattern of Life GIME Practice Questions (Page 8)

Questions 36–40

An examiner is preparing a forensic report on a user's location-based habits. The examiner has data from the iOS location cache, Wi-Fi logs, and app usage. Which presentation format would best illustrate the user's frequent locations and times?

An examiner is preparing a report for a corporate investigation about a user's daily activities. The examiner has data from multiple iOS and macOS artifacts. The report will be reviewed by both technical and non-technical stakeholders. Which presentation approach best serves both audiences?

An examiner is reconstructing a user's daily routine from an iOS device. The examiner has access to the device's knowledgeC database, location services cache, and app usage data. Which approach would best establish a chronological pattern of the user's morning activities?

During a forensic examination of a macOS system, which of the following system artifacts would most directly reveal the times a user typically logs in and out of the system?

Keep studying — Forensic Analysis and Artifacts