An examiner is analyzing a macOS user's Reminders app. The user has multiple accounts (iCloud, Exchange, and local). The examiner needs to determine which account a specific reminder belongs to. Which field in the Reminders database should the examiner examine?

The 'ZACCOUNT' field in the ZREMINDER table

The 'ZLIST' field in the ZREMINDER table

The 'ZPRIORITY' field in the ZREMINDER table

The 'ZCREATIONDATE' field in the ZREMINDER table

An examiner is analyzing a macOS system where the user cleared Safari's history and cookies. However, the examiner needs to determine if the user visited a specific website. Which approach is most likely to yield evidence despite the clearing?

Analyze the Mail application's Envelope Index for any emails containing the website URL

Examine the Safari cache files and the HFS+/APFS file system free space for remnants of the website's data

Look at the user's Reminders database for any notes about the website

Check the Safari Extensions folder for any extensions that might have logged activity

An examiner is investigating a suspect's iPhone. The suspect used a messaging app that encrypts messages in transit but stores them in plaintext locally. The examiner also finds that the suspect used Safari to access a webmail service. Which approach would be most efficient to recover the suspect's communications?

Examine the Mail application's Envelope Index for messages

Extract the messaging app's local database and the Safari cache for webmail content

Analyze the Reminders database for any notes about communications

Contact the messaging service provider for message logs

A forensic examiner is investigating a macOS system where the user used both Mail and a third-party messaging app. The examiner needs to determine if the user communicated with a specific person via email or the messaging app. Which data sources should the examiner prioritize?

Mail's Envelope Index and the messaging app's local database

The messaging app's keychain entries and Mail's preferences plist

Mail's Accounts.plist and Safari's Extensions folder

Safari's History.db and Cookies.binarycookies

In an investigation, an examiner finds a messaging app on a seized iPhone. The app uses end-to-end encryption. The examiner needs to recover the list of contacts and the content of conversations. Which approach is most appropriate?

Contact the service provider to request the decryption keys

Check the device's mail application for the messages

Examine the app's local database and keychain entries for decryption keys

Analyze the Safari cache for the conversation content

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 6)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 26–30

26application · medium
An examiner is analyzing a macOS user's Reminders app. The user has multiple accounts (iCloud, Exchange, and local). The examiner needs to determine which account a specific reminder belongs to. Which field in the Reminders database should the examiner examine?
Select an answer first
27expert · hard
An examiner is analyzing a macOS system where the user cleared Safari's history and cookies. However, the examiner needs to determine if the user visited a specific website. Which approach is most likely to yield evidence despite the clearing?
Select an answer first
28expert · hard
An examiner is investigating a suspect's iPhone. The suspect used a messaging app that encrypts messages in transit but stores them in plaintext locally. The examiner also finds that the suspect used Safari to access a webmail service. Which approach would be most efficient to recover the suspect's communications?
Select an answer first
29application · medium
A forensic examiner is investigating a macOS system where the user used both Mail and a third-party messaging app. The examiner needs to determine if the user communicated with a specific person via email or the messaging app. Which data sources should the examiner prioritize?
Select an answer first
30application · medium
In an investigation, an examiner finds a messaging app on a seized iPhone. The app uses end-to-end encryption. The examiner needs to recover the list of contacts and the content of conversations. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.