An examiner is investigating a suspect's iPhone. The suspect used a messaging app that stores messages in a SQLite database, and also used the Reminders app. The examiner needs to determine if the suspect had planned a meeting with a contact. Which approach would be most effective?

Examine the Mail application's Envelope Index for meeting invitations

Analyze Safari's History.db for meeting-related web searches

Search the messaging app's database for conversation content and cross-reference with the Reminders database for meeting-related entries

Check the device's keychain for meeting-related passwords

Which of the following is a data store that Safari uses to keep track of website data such as cookies and local storage?

~/Library/Preferences/com.apple.Safari.Cookies.plist

~/Library/Caches/com.apple.Safari/Cookies.db

~/Library/Safari/WebsiteData.db

~/Library/Safari/Cookies.binarycookies

During an investigation, an examiner needs to determine whether a suspect used a VoIP app to make calls. The app is installed on the iPhone. Which data source would provide evidence of call history?

The keychain entries for the app

The app's local database, such as call history and contact tables

An examiner is analyzing a macOS Mail data store and needs to recover the content of an email that was sent by the user. Which file would contain the sent message?

~/Library/Mail/V10/accountname/Sent.mbox/

~/Library/Mail/V10/MailData/Envelope Index

~/Library/Mail/V10/MailData/Accounts.plist

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 5)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 21–25

21expert · hard
An examiner is investigating a suspect's iPhone. The suspect used a messaging app that stores messages in a SQLite database, and also used the Reminders app. The examiner needs to determine if the suspect had planned a meeting with a contact. Which approach would be most effective?
Select an answer first
22foundation · medium
Which of the following is a data store that Safari uses to keep track of website data such as cookies and local storage?
Select an answer first
23foundation · medium
In a macOS Mail configuration file, which key is commonly used to store the username for an email account?
Select an answer first
24application · medium
During an investigation, an examiner needs to determine whether a suspect used a VoIP app to make calls. The app is installed on the iPhone. Which data source would provide evidence of call history?
Select an answer first
25application · medium
An examiner is analyzing a macOS Mail data store and needs to recover the content of an email that was sent by the user. Which file would contain the sent message?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.