Mac Basics for Forensics
101 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which operating system was developed as a replacement for Apple DOS 3.3 and had more support for programming, including assembly and BASIC?

  • ProDOS (correct)
  • Lisa OS
  • Apple SOS
  • Apple Pascal

    • What was the name of the first edition of the Apple DOS released in 1978?

  • Apple Pascal
  • ProDOS 16
  • Apple SOS
  • Apple DOS 3.1 (correct)

    • Which Apple II model was the first to feature color graphics in a plastic case with a built-in keyboard?

  • Apple II+ (correct)
  • Apple IIc+
  • Apple IIe Enhanced
  • Apple IIGS

    • What was the acronym SOS in Apple SOS operating system stood for?

    <p>Sophisticated Operating System</p> Signup and view all the answers

    Which Apple II model was released as a 16-bit computer, unlike its predecessors which were 8-bit?

    <p>Apple IIGS</p> Signup and view all the answers

    Which operating system had a full graphical user interface with a file browser navigated with mouse clicks?

    <p>Lisa OS</p> Signup and view all the answers

    What is the main reason many forensic examiners lack a good working knowledge of Mac OS systems?

    <p>They have more exposure to Windows than to Mac OS.</p> Signup and view all the answers

    Who were the three founders of Apple Computer?

    <p>Steve Wozniak, Steve Jobs, Ronald Wayne</p> Signup and view all the answers

    What was the first computer created by Wozniak for Apple Computer?

    <p>Apple I</p> Signup and view all the answers

    Which company originally had the right of first refusal on any new inventions by Steve Wozniak?

    <p>Hewlett-Packard</p> Signup and view all the answers

    How fast was the 8-bit microprocessor in the first Apple computer running?

    <p>~1 MHz</p> Signup and view all the answers

    What technology did Steve Wozniak's employment contract with Hewlett-Packard lead to being released to him?

    <p>The technology of the first Apple computer.</p> Signup and view all the answers

    What was the main change with the introduction of Mac OS X?

    <p>It was the first Apple operating system to use a Unix clone.</p> Signup and view all the answers

    Which product introduced by Apple did not perform well in the market and was discontinued in 1997?

    <p>Apple Network Server with AIX system</p> Signup and view all the answers

    What was the operating system for the Macintosh computer initially released by Apple in January 1984?

    <p>System 7</p> Signup and view all the answers

    Which processor speed did the Macintosh have when it was released in January 1984?

    <p>8 MHz</p> Signup and view all the answers

    What distinguished the Macintosh II from its predecessor, the Macintosh?

    <p>Had a color display</p> Signup and view all the answers

    In what year did Apple release the Apple Network Server with a variation of the IBM AIX system?

    <p>1996</p> Signup and view all the answers

    When did Apple change the operating system brand name to macOS?

    <p>2016</p> Signup and view all the answers

    Which Mac OS version introduced Handoff, allowing interaction between iPhones and Mac OS computers?

    <p>Yosemite</p> Signup and view all the answers

    What was the main focus of Mac OS X 10.6, Snow Leopard, upon its release in 2009?

    <p>Performance enhancements</p> Signup and view all the answers

    Which Mac OS version was the last to be named after animals?

    <p>Mountain Lion</p> Signup and view all the answers

    What was one significant change in Mac OS X v10.7, Lion, regarding its interface?

    <p>Making it more like iOS interfaces</p> Signup and view all the answers

    Which Mac OS version allowed users to complete unfinished iPhone emails on their Mac OS computer?

    <p>Yosemite</p> Signup and view all the answers

    What technology supported by Big Sur helps ease the transition to Apple's silicon processor architecture?

    <p>File-level encryption</p> Signup and view all the answers

    Which Mac OS version included built-in support for iCloud to support cloud computing?

    <p>Mountain Lion</p> Signup and view all the answers

    Which file system used concepts from the SOS operating system designed for the Apple III?

    <p>Hierarchical File System</p> Signup and view all the answers

    Which file system introduced to support Apple's new hard drive in 1985?

    <p>HFS Standard</p> Signup and view all the answers

    Which file system supported filenames of up to 255 characters, unlike the DOS system?

    <p>HFS</p> Signup and view all the answers

    Which file system was an enhancement of the HFS file system?

    <p>Hierarchical File System Plus</p> Signup and view all the answers

    Which file system replaced the HFS file system with Mac OS 8.1?

    <p>Hierarchical File System Plus</p> Signup and view all the answers

    Which file system feature keeps a record of file transactions to aid in file recovery after a crash?

    <p>Journaling</p> Signup and view all the answers

    What type of link in HFS+ is an inode linking directly to a specific file?

    <p>Hard link</p> Signup and view all the answers

    Which file system uses Unicode for file naming information encoding?

    <p>HFS+</p> Signup and view all the answers

    When does an HFS+ file get defragmented upon opening?

    <p>If the file is less than 20 megabytes in size and fragmented</p> Signup and view all the answers

    What storage system used in HFS+ keeps track of free and in-use allocation blocks?

    <p>Catalog file</p> Signup and view all the answers

    Which Mac OS feature allows execution of Linux commands through a BASH shell prompt?

    <p>Command prompt</p> Signup and view all the answers

    In HFS+, what is a significant difference compared to HFS regarding allocation blocks?

    <p>HFS uses 16 bits while HFS+ uses 32 bits for allocation blocks.</p> Signup and view all the answers

    What file system is used by DVD-ROM discs?

    <p>Universal Disk Format</p> Signup and view all the answers

    What is a key feature of APFS in comparison to HFS+?

    <p>Optimized for flash drives and solid-state drives</p> Signup and view all the answers

    Which partition scheme is used primarily with computers that have an Intel-based processor?

    <p>GUID Partition Table</p> Signup and view all the answers

    Which file system is associated with CDs?

    <p>ISO9660</p> Signup and view all the answers

    What utility allows one to install additional operating systems alongside Mac OS in a nondestructive manner?

    <p>Boot Camp Assistant</p> Signup and view all the answers

    What type of drive partition can Mac OS read with read-only support?

    <p>NTFS</p> Signup and view all the answers

    What does the Apple Partition Map work with?

    <p>PowerPC-based Macs</p> Signup and view all the answers

    Which Apple device is likely to use APFS as its file system?

    <p>iPad Pro (released in 2016)</p> Signup and view all the answers

    Which partition scheme requires OS X v10.4 or later?

    <p>GUID Partition Table</p> Signup and view all the answers

    Which file system has specific extensions developed by Apple?

    <p>ISO9660</p> Signup and view all the answers

    What should you not create if the system is using APFS according to the text?

    <p>Separate partition for Windows dual boot</p> Signup and view all the answers

    In Mac OS, support for which file system allows reading floppy disks?

    <p>FAT16</p> Signup and view all the answers

    What type of information can be found in the /var/spool/cups folder in Mac OS logs?

    <p>Details about printed documents</p> Signup and view all the answers

    Which log in Mac OS provides data on all mounted volumes, including the dates they were mounted?

    <p>/var/log/daily.out</p> Signup and view all the answers

    In Mac OS, which folder can give information about devices that have been attached and data from them?

    <p>/var/log/daily.out</p> Signup and view all the answers

    What is the significance of the /private/var/audit logs in Mac OS forensics?

    <p>Logs of system audits, including user login</p> Signup and view all the answers

    Which log directory in Mac OS is similar to Linux file structures due to its FreeBSD base?

    <p>/var/log</p> Signup and view all the answers

    Why is checking logs considered one of the first steps in any forensic examination?

    <p>Because logs are essential sources of information in computer examinations</p> Signup and view all the answers

    Where can important forensic data be found in Mac OS audit logs?

    <p>/private/var/VM Folder</p> Signup and view all the answers

    Which folder in Mac OS contains user preferences, including preferences of deleted programs?

    <p>/Users//Library/Preferences Folder</p> Signup and view all the answers

    In which folder of Mac OS can you find lists of recently opened applications and temporary data used by applications?

    <p>/var/vm Folder</p> Signup and view all the answers

    Where would you look to find items saved to iCloud in Mac OS?

    <p>/Library/Mobile Documents</p> Signup and view all the answers

    Which folder in Mac OS is less useful for forensic investigation but can indicate if a patch was applied and when?

    <p>/Library/Receipts Folder</p> Signup and view all the answers

    Where can you find a log showing a variety of commands executed in the terminal window of Mac OS?

    <p>/Users//.bash_history Log</p> Signup and view all the answers

    Where can a forensic examiner find information about mounted devices in Mac OS?

    <p>/Volumes Directory</p> Signup and view all the answers

    Which Mac OS directory should a forensic examiner check primarily for user accounts and associated files?

    <p>/Users Directory</p> Signup and view all the answers

    In a forensic examination of a Mac machine, where would an examiner look for network properties and servers information?

    <p>/Network Directory</p> Signup and view all the answers

    Which Mac OS directory is particularly important to check in cases involving malware?

    <p>/Applications Directory</p> Signup and view all the answers

    Where are configuration files typically located in a Mac OS system that could be of interest in a forensic investigation?

    <p>/etc Directory</p> Signup and view all the answers

    If an examiner needs data regarding mounted devices like CDs and external disks in Mac OS, which directory should they explore?

    <p>/Volumes Directory</p> Signup and view all the answers

    Where is the network configuration data for each network card stored in Mac OS?

    <p>/Library/Preferences/SystemConfiguration/dom.apple.preferences.plist File</p> Signup and view all the answers

    Which Mac OS directory is essential for examining user accounts and associated files?

    <p>/Users Directory</p> Signup and view all the answers

    Where can an examiner find information about servers, network libraries, and network properties in Mac OS?

    <p>/Network Directory</p> Signup and view all the answers

    In which Mac OS directory are configuration files located, often manipulated by cybercriminals?

    <p>/etc Directory</p> Signup and view all the answers

    Where does an examiner need to look to find information on mounted devices like CDs and external disks in Mac OS?

    <p>/Volumes Directory</p> Signup and view all the answers

    Which directory in Mac OS stores applications and is particularly critical to check in cases involving malware?

    <p>/Applications Directory</p> Signup and view all the answers

    What is one advantage of using Target Disk Mode in a Mac OS forensic investigation?

    <p>It provides a quick inspection on-site before transporting the computer</p> Signup and view all the answers

    Which tool can be used in Mac OS forensics to create a bit-level copy of a suspect drive?

    <p>EnCase</p> Signup and view all the answers

    In Mac OS forensics, what command can be used along with netcat to make a forensic copy of a drive?

    <p>dd</p> Signup and view all the answers

    What is the primary benefit of placing the suspect computer into Target Disk Mode during imaging?

    <p>Prevents writing to the source disk</p> Signup and view all the answers

    What differentiates Target Disk Mode from traditional imaging tools like EnCase or Forensic Toolkit in Mac OS forensics?

    <p>Provides a way to preview the computer on-site</p> Signup and view all the answers

    Which option correctly describes the process of connecting to a suspect computer in Target Disk Mode?

    <p>Connect with USB or FireWire for imaging the disk</p> Signup and view all the answers

    What is the purpose of using the ls -al command in a Mac OS forensic examination?

    <p>To list all the files in virtual memory along with program launch details</p> Signup and view all the answers

    Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

    <p>ls/dev/disk?</p> Signup and view all the answers

    In Mac OS forensics, what information can be obtained using the system_profiler SPHardwareDataType command?

    <p>Hardware information of the host system</p> Signup and view all the answers

    Which directory in Mac OS is particularly important to check for user accounts and associated files during a forensic investigation?

    <p>/private/var/audit</p> Signup and view all the answers

    What type of information does the date command provide in a Mac OS forensic examination?

    <p>Current date and time zone</p> Signup and view all the answers

    Why is it essential to know the partitions recognized by a Mac machine upon boot-up in a forensic examination?

    <p>To understand the storage allocation blocks on the device</p> Signup and view all the answers

    What is the purpose of using the ls -al command in a Mac OS forensic examination?

    <p>To list all files in the virtual memory folder along with additional details</p> Signup and view all the answers

    What information does the date command provide in a forensic examination on a Mac OS?

    <p>Current date and time of the system</p> Signup and view all the answers

    Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

    <p>ls /dev/disk?</p> Signup and view all the answers

    Why is it important to document the information from the ls /dev/disk? command before shutting down a Mac system for transport to a forensic lab?

    <p>To identify mounted devices on the system</p> Signup and view all the answers

    What type of information does the system_profiler SPHardwareDataType command return in a forensic examination on a Mac OS?

    <p>Hardware information for the host system</p> Signup and view all the answers

    In Mac OS forensics, what does the grep search tool allow an examiner to do in the virtual memory folder?

    <p>Search for specific files based on content</p> Signup and view all the answers

    Which folder in Mac OS contains the swap file/virtual memory?

    <p>/var/vm/</p> Signup and view all the answers

    How can a forensic examiner check the partitions recognized by a Mac machine upon boot-up?

    <p><code>ls /dev/disk?</code> command</p> Signup and view all the answers

    What is a significant advantage of using shell commands in Mac OS forensic examinations?

    <p>To retrieve information from virtual memory</p> Signup and view all the answers

    What does the hdiutil partition /dev/disk0 command primarily help in listing during a forensic examination of a Mac system?

    <p>Boot drive partition table</p> Signup and view all the answers

    What is a critical step to remember when mounting a forensic image as a VM?

    <p>Mount it as read-only</p> Signup and view all the answers

    Which software mentioned allows the creation of a VM from a forensic image?

    <p>OSForensics version 4</p> Signup and view all the answers

    In Mac OS forensics, what is the purpose of converting a forensic image to a VM?

    <p>To maintain data integrity and prevent modifications</p> Signup and view all the answers

    Which tool allows mounting forensic images as read-only VMs using the VM of your choice?

    <p>Forensic Explorer</p> Signup and view all the answers

    What technique is recommended to examine directories and execute BASH commands in Mac OS forensics when standard tools are insufficient?

    <p>Creating a read-only VM from the forensic image</p> Signup and view all the answers

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser