Deck 19: Digital Evidence on Macintosh Systems

Question 1

Examination of a Mac computer must be done manually - no automated tools exist.

Answer 1

False

Question 2

Keychains (~/Library/Keychains) are files that store:

A) Usernames and passwords
B) Private encryption keys
C) Favorite websites
D) Recent documents

Answer 2

A

Question 3

Macintosh disks can only be examined on a Macintosh system.

Answer 3

False

Question 4

The boot sector and additional details about the volume are stored in:

A) The first sector of the volume
B) At offset 0x300 from the beginning of the drive
C) The last sector of the volume
D) CMOS

Question 5

It may not be possible to recover the file names and date-time stamps from an HFS volume with forensic tools because:

A) That information is overwritten when a file is deleted.
B) The inode table is deleted.
C) That information is only held in memory.
D) The B-tree data structure frequently rebalances.

Question 6

The most common approach to salvaging deleted data on Macintosh systems is to:

A) Use EnCase to recover the files.
B) Use the Catalog utility.
C) Use file carving techniques.
D) There is currently no solution to recovering deleted files from a Macintosh.

Question 7

The HFS equivalent to the NTFS MFT is:

A) Lister file
B) Files.db
C) Catalog file
D) Seeker.db

Question 8

A difference between HFS and other file systems studied is that folders:

A) Are listed in a separate Extents Overflow file
B) Do not contain lists of their contents
C) Do not show when they were last backed up
D) Are stored in two places on the disk

Question 9

HFS Plus stores file and folder names in Unicode format.

Question 10

When a file is deleted, its Catalog entry may be deleted as well. If this occurs,

A) A backup of the Catalog file will still contain the information.
B) All references to the data are removed from the disk.
C) The file information is moved to the Extent Overflow file.
D) The file information is moved to ".Trash," with the same name as the file, and an extent of ".info."

Question 11

HFS represents time as:

A) The number of nanoseconds since January 1, 1601 00:00:00 GMT
B) The number of milliseconds since January 1, 1980 00:00:00 GMT
C) The number of seconds since January 1, 1601 00:00:00 GMT
D) The number of seconds since January 1, 1904 00:00:00 GMT

Question 12

Macintosh stores its partition table in:

A) The last sector of the drive
B) Non-volatile memory
C) The first sector of the drive
D) At offset 1024

Question 13

The default browser used on Mac OS X is:

A) Internet Explorer
B) Safari
C) Firefox
D) Opera

Question 14

The folder ~/Library/Mail Downloads contains:

A) Internet downloads
B) E-mails that contain attachments
C) Unread e-mails
D) E-mail attachments that have been opened

Question 15

There is a wide selection of forensic tools available for exploiting Macs.

Question 16

On Mac OS X, when a file is deleted, it is copied to the:

A) Recycler folder
B) .Trash folder
C) [orphans]
D) None of the above

Question 17

The last access times of files copied from a Mac running OS 9 onto a FAT-formatted disk are meaningless because HFS does not maintain:

A) Access time
B) Modified time
C) Created time
D) Ctime

Question 18

Recently accessed files and applications are listed in:

A) ~/Library/Recent
B) Catalog:Recent
C) ~/Library/Preferences/com.apple.recent.items
D) com.apple.TextEdit.plist

Question 19

By default, when Mac OS X boots up, it will attempt to mount an evidence disk.

Question 20

HFS supports a maximum of__________ clusters.

A) 2⁸
B) 2¹⁶
C) 2³²
D) 2⁶⁴

Question 21

Typically, the degree of e-mail logging is dependent on the application.

Question 22

On a Macintosh, when a file is deleted, its key length is set to zero.

Question 23

Due to the design of the Macintosh Catalog file, it is easy to recover deleted files manually, using forensic tools.

Question 24

In each volume of a Macintosh system, there is a database named "Desktop DB" that contains information about activities on the system including programs that were run and files and websites that were accessed.

Question 25

All ".plist" files are in plaintext.

Question 26

Mac OS X has logging capabilities, but OS9 did not.

Question 27

Internet Explorer cookies are always found in System
Folder:Preferences:Explorer:Cookies.txt.

Question 28

Digital evidence examiners can use The Sleuth Kit on Mac OS X to examine NTFS, FAT, UFS, EXT, and HFS file systems.

Question 29

By default, Eudora for Macintosh records more information than Eudora for Windows.