An examiner is analyzing a macOS user's Reminders app. The user has a reminder with a due date that has passed. The examiner needs to determine if the reminder was completed. Which field in the Reminders database should the examiner examine?

The 'ZCREATIONDATE' field in the ZREMINDER table

The 'ZDUEDATE' field in the ZREMINDER table

The 'ZCOMPLETED' field in the ZREMINDER table

The 'ZPRIORITY' field in the ZREMINDER table

During an investigation, an examiner needs to recover a deleted email message from a macOS Mail account that uses IMAP. The message is not present in the current mailbox. Which approach is most likely to recover the message content?

Examine the Envelope Index SQLite database for the message metadata and locate the corresponding message file in the mailbox directory

Look in the ~/Library/Mail/V10/MailData/Accounts.plist for the message content

Search the user's Safari cache for the email content

Check the server-side trash folder via the mail server logs

On macOS, where does the Reminders app store its task data?

In a JSON file in Application Support

In a Core Data store in the Documents folder

In a SQLite database in the app's container

An examiner is analyzing a macOS system and finds that Safari's history database is empty. However, the examiner suspects the user browsed the web. Which alternative data source might contain remnants of web activity?

~/Library/Mail/V10/MailData/Envelope Index

~/Library/Cookies/Cookies.binarycookies

~/Library/Preferences/com.apple.Safari.plist

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 2)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 6–10

6foundation · medium
When analyzing a messaging app on macOS, which common data store would you examine to recover chat conversations?
Select an answer first
7application · medium
An examiner is analyzing a macOS user's Reminders app. The user has a reminder with a due date that has passed. The examiner needs to determine if the reminder was completed. Which field in the Reminders database should the examiner examine?
Select an answer first
8application · medium
During an investigation, an examiner needs to recover a deleted email message from a macOS Mail account that uses IMAP. The message is not present in the current mailbox. Which approach is most likely to recover the message content?
Select an answer first
9foundation · medium
On macOS, where does the Reminders app store its task data?
Select an answer first
10application · medium
An examiner is analyzing a macOS system and finds that Safari's history database is empty. However, the examiner suspects the user browsed the web. Which alternative data source might contain remnants of web activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.