An examiner is analyzing a macOS device. The user has a Mail account configured with IMAP. The examiner needs to determine if the user accessed email from a different device. Which artifact would be most useful?

The 'Received' headers in emails stored in the Mail data store

The 'IMAP' account's 'Last Login' timestamp in Accounts.plist

The 'Message-ID' header in emails

The 'X-Mailer' header in emails

An examiner is analyzing a macOS system where the user used Mail with multiple accounts, Safari with private browsing, and a messaging app. The examiner needs to determine which email account was used to send a specific message. Which data source would provide the most direct evidence?

Safari's History.db, which may show webmail activity

The Envelope Index database, which records the sending account for each message

The Accounts.plist file, which lists all configured accounts

The messaging app's database, which may contain the same message

An examiner is investigating a macOS device used by a suspect. The suspect used FaceTime to communicate with an accomplice. The examiner needs to recover the call history, including the date, time, and duration of calls. Which data store should the examiner examine?

~/Library/Preferences/com.apple.facetime.plist

~/Library/Application Support/CallHistoryDB/CallHistory.storedata

On macOS, where does the Mail app store the actual message content (email bodies and attachments) for a user's local mailboxes?

~/Library/Caches/com.apple.mail/

~/Library/Application Support/Mail/

~/Library/Containers/com.apple.mail/

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 4)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 16–20

16expert · hard
An examiner is analyzing a macOS device. The user has a Mail account configured with IMAP. The examiner needs to determine if the user accessed email from a different device. Which artifact would be most useful?
Select an answer first
17expert · hard
An examiner is analyzing a macOS system where the user used Mail with multiple accounts, Safari with private browsing, and a messaging app. The examiner needs to determine which email account was used to send a specific message. Which data source would provide the most direct evidence?
Select an answer first
18application · medium
An examiner is investigating a macOS device used by a suspect. The suspect used FaceTime to communicate with an accomplice. The examiner needs to recover the call history, including the date, time, and duration of calls. Which data store should the examiner examine?
Select an answer first
19foundation · medium
In Safari's preferences, which key indicates whether the user has enabled the 'Block All Cookies' privacy setting?
Select an answer first
20foundation · medium
On macOS, where does the Mail app store the actual message content (email bodies and attachments) for a user's local mailboxes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.