GIAC iOS and macOS Examiner - GIME Exam Practice Test

A. EXT4

B. HFS+

C. APFS

D. NTFS

A. Spotlight search history

B. Account creation dates

C. User preference files

D. Application usage statistics

A. To enhance encryption protocols

B. To verify data integrity

C. To repair corrupted files

D. To bypass encryption mechanisms

A. Raw disk images

B. Operating system updates

C. System logs

D. Device settings, messages, and app data

A. To create a comprehensive picture of system activity

B. To increase the boot time of forensic analysis tools

C. To reduce the overall size of the log files

D. To enhance the visual appeal of the report

A. MAC address of connected devices

B. Timestamps of user login and logout events

C. Timestamp of system kernel panics

D. Frequency of app updates

A. Terminal

B. iCloud Extractor

C. Activity Monitor

D. Blacklight

A. Media library

B. Installed games

C. Screen saver settings

D. Management profiles

A. It affects file naming conventions.

B. It influences the brute force attack time.

C. It determines the color depth of files.

D. It changes the container's metadata structure.

A. Inspecting network preferences

B. Checking the firewall status

C. Analyzing email configurations

D. Reviewing browser cookies

A. Installed applications

B. Operating system version

C. Color depth of the display

D. File and folder names

A. Data acquisition requires the device to be online, while system acquisition does not.

B. System acquisition involves capturing the entire system state, while data acquisition may be selective.

C. System acquisition includes metadata, whereas data acquisition does not.

D. System acquisition is user-focused, while data acquisition is system-focused.