Mac Basics for Forensics
101 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which operating system was developed as a replacement for Apple DOS 3.3 and had more support for programming, including assembly and BASIC?

  • ProDOS (correct)
  • Lisa OS
  • Apple SOS
  • Apple Pascal

    • What was the name of the first edition of the Apple DOS released in 1978?

  • Apple Pascal
  • ProDOS 16
  • Apple SOS
  • Apple DOS 3.1 (correct)

    • Which Apple II model was the first to feature color graphics in a plastic case with a built-in keyboard?

  • Apple II+ (correct)
  • Apple IIc+
  • Apple IIe Enhanced
  • Apple IIGS

    • What was the acronym SOS in Apple SOS operating system stood for?

    <p>Sophisticated Operating System</p> Signup and view all the answers

    Which Apple II model was released as a 16-bit computer, unlike its predecessors which were 8-bit?

    <p>Apple IIGS</p> Signup and view all the answers

    Which operating system had a full graphical user interface with a file browser navigated with mouse clicks?

    <p>Lisa OS</p> Signup and view all the answers

    What is the main reason many forensic examiners lack a good working knowledge of Mac OS systems?

    <p>They have more exposure to Windows than to Mac OS.</p> Signup and view all the answers

    Who were the three founders of Apple Computer?

    <p>Steve Wozniak, Steve Jobs, Ronald Wayne</p> Signup and view all the answers

    What was the first computer created by Wozniak for Apple Computer?

    <p>Apple I</p> Signup and view all the answers

    Which company originally had the right of first refusal on any new inventions by Steve Wozniak?

    <p>Hewlett-Packard</p> Signup and view all the answers

    How fast was the 8-bit microprocessor in the first Apple computer running?

    <p>~1 MHz</p> Signup and view all the answers

    What technology did Steve Wozniak's employment contract with Hewlett-Packard lead to being released to him?

    <p>The technology of the first Apple computer.</p> Signup and view all the answers

    What was the main change with the introduction of Mac OS X?

    <p>It was the first Apple operating system to use a Unix clone.</p> Signup and view all the answers

    Which product introduced by Apple did not perform well in the market and was discontinued in 1997?

    <p>Apple Network Server with AIX system</p> Signup and view all the answers

    What was the operating system for the Macintosh computer initially released by Apple in January 1984?

    <p>System 7</p> Signup and view all the answers

    Which processor speed did the Macintosh have when it was released in January 1984?

    <p>8 MHz</p> Signup and view all the answers

    What distinguished the Macintosh II from its predecessor, the Macintosh?

    <p>Had a color display</p> Signup and view all the answers

    In what year did Apple release the Apple Network Server with a variation of the IBM AIX system?

    <p>1996</p> Signup and view all the answers

    When did Apple change the operating system brand name to macOS?

    <p>2016</p> Signup and view all the answers

    Which Mac OS version introduced Handoff, allowing interaction between iPhones and Mac OS computers?

    <p>Yosemite</p> Signup and view all the answers

    What was the main focus of Mac OS X 10.6, Snow Leopard, upon its release in 2009?

    <p>Performance enhancements</p> Signup and view all the answers

    Which Mac OS version was the last to be named after animals?

    <p>Mountain Lion</p> Signup and view all the answers

    What was one significant change in Mac OS X v10.7, Lion, regarding its interface?

    <p>Making it more like iOS interfaces</p> Signup and view all the answers

    Which Mac OS version allowed users to complete unfinished iPhone emails on their Mac OS computer?

    <p>Yosemite</p> Signup and view all the answers

    What technology supported by Big Sur helps ease the transition to Apple's silicon processor architecture?

    <p>File-level encryption</p> Signup and view all the answers

    Which Mac OS version included built-in support for iCloud to support cloud computing?

    <p>Mountain Lion</p> Signup and view all the answers

    Which file system used concepts from the SOS operating system designed for the Apple III?

    <p>Hierarchical File System</p> Signup and view all the answers

    Which file system introduced to support Apple's new hard drive in 1985?

    <p>HFS Standard</p> Signup and view all the answers

    Which file system supported filenames of up to 255 characters, unlike the DOS system?

    <p>HFS</p> Signup and view all the answers

    Which file system was an enhancement of the HFS file system?

    <p>Hierarchical File System Plus</p> Signup and view all the answers

    Which file system replaced the HFS file system with Mac OS 8.1?

    <p>Hierarchical File System Plus</p> Signup and view all the answers

    Which file system feature keeps a record of file transactions to aid in file recovery after a crash?

    <p>Journaling</p> Signup and view all the answers

    What type of link in HFS+ is an inode linking directly to a specific file?

    <p>Hard link</p> Signup and view all the answers

    Which file system uses Unicode for file naming information encoding?

    <p>HFS+</p> Signup and view all the answers

    When does an HFS+ file get defragmented upon opening?

    <p>If the file is less than 20 megabytes in size and fragmented</p> Signup and view all the answers

    What storage system used in HFS+ keeps track of free and in-use allocation blocks?

    <p>Catalog file</p> Signup and view all the answers

    Which Mac OS feature allows execution of Linux commands through a BASH shell prompt?

    <p>Command prompt</p> Signup and view all the answers

    In HFS+, what is a significant difference compared to HFS regarding allocation blocks?

    <p>HFS uses 16 bits while HFS+ uses 32 bits for allocation blocks.</p> Signup and view all the answers

    What file system is used by DVD-ROM discs?

    <p>Universal Disk Format</p> Signup and view all the answers

    What is a key feature of APFS in comparison to HFS+?

    <p>Optimized for flash drives and solid-state drives</p> Signup and view all the answers

    Which partition scheme is used primarily with computers that have an Intel-based processor?

    <p>GUID Partition Table</p> Signup and view all the answers

    Which file system is associated with CDs?

    <p>ISO9660</p> Signup and view all the answers

    What utility allows one to install additional operating systems alongside Mac OS in a nondestructive manner?

    <p>Boot Camp Assistant</p> Signup and view all the answers

    What type of drive partition can Mac OS read with read-only support?

    <p>NTFS</p> Signup and view all the answers

    What does the Apple Partition Map work with?

    <p>PowerPC-based Macs</p> Signup and view all the answers

    Which Apple device is likely to use APFS as its file system?

    <p>iPad Pro (released in 2016)</p> Signup and view all the answers

    Which partition scheme requires OS X v10.4 or later?

    <p>GUID Partition Table</p> Signup and view all the answers

    Which file system has specific extensions developed by Apple?

    <p>ISO9660</p> Signup and view all the answers

    What should you not create if the system is using APFS according to the text?

    <p>Separate partition for Windows dual boot</p> Signup and view all the answers

    In Mac OS, support for which file system allows reading floppy disks?

    <p>FAT16</p> Signup and view all the answers

    What type of information can be found in the /var/spool/cups folder in Mac OS logs?

    <p>Details about printed documents</p> Signup and view all the answers

    Which log in Mac OS provides data on all mounted volumes, including the dates they were mounted?

    <p>/var/log/daily.out</p> Signup and view all the answers

    In Mac OS, which folder can give information about devices that have been attached and data from them?

    <p>/var/log/daily.out</p> Signup and view all the answers

    What is the significance of the /private/var/audit logs in Mac OS forensics?

    <p>Logs of system audits, including user login</p> Signup and view all the answers

    Which log directory in Mac OS is similar to Linux file structures due to its FreeBSD base?

    <p>/var/log</p> Signup and view all the answers

    Why is checking logs considered one of the first steps in any forensic examination?

    <p>Because logs are essential sources of information in computer examinations</p> Signup and view all the answers

    Where can important forensic data be found in Mac OS audit logs?

    <p>/private/var/VM Folder</p> Signup and view all the answers

    Which folder in Mac OS contains user preferences, including preferences of deleted programs?

    <p>/Users//Library/Preferences Folder</p> Signup and view all the answers

    In which folder of Mac OS can you find lists of recently opened applications and temporary data used by applications?

    <p>/var/vm Folder</p> Signup and view all the answers

    Where would you look to find items saved to iCloud in Mac OS?

    <p>/Library/Mobile Documents</p> Signup and view all the answers

    Which folder in Mac OS is less useful for forensic investigation but can indicate if a patch was applied and when?

    <p>/Library/Receipts Folder</p> Signup and view all the answers

    Where can you find a log showing a variety of commands executed in the terminal window of Mac OS?

    <p>/Users//.bash_history Log</p> Signup and view all the answers

    Where can a forensic examiner find information about mounted devices in Mac OS?

    <p>/Volumes Directory</p> Signup and view all the answers

    Which Mac OS directory should a forensic examiner check primarily for user accounts and associated files?

    <p>/Users Directory</p> Signup and view all the answers

    In a forensic examination of a Mac machine, where would an examiner look for network properties and servers information?

    <p>/Network Directory</p> Signup and view all the answers

    Which Mac OS directory is particularly important to check in cases involving malware?

    <p>/Applications Directory</p> Signup and view all the answers

    Where are configuration files typically located in a Mac OS system that could be of interest in a forensic investigation?

    <p>/etc Directory</p> Signup and view all the answers

    If an examiner needs data regarding mounted devices like CDs and external disks in Mac OS, which directory should they explore?

    <p>/Volumes Directory</p> Signup and view all the answers

    Where is the network configuration data for each network card stored in Mac OS?

    <p>/Library/Preferences/SystemConfiguration/dom.apple.preferences.plist File</p> Signup and view all the answers

    Which Mac OS directory is essential for examining user accounts and associated files?

    <p>/Users Directory</p> Signup and view all the answers

    Where can an examiner find information about servers, network libraries, and network properties in Mac OS?

    <p>/Network Directory</p> Signup and view all the answers

    In which Mac OS directory are configuration files located, often manipulated by cybercriminals?

    <p>/etc Directory</p> Signup and view all the answers

    Where does an examiner need to look to find information on mounted devices like CDs and external disks in Mac OS?

    <p>/Volumes Directory</p> Signup and view all the answers

    Which directory in Mac OS stores applications and is particularly critical to check in cases involving malware?

    <p>/Applications Directory</p> Signup and view all the answers

    What is one advantage of using Target Disk Mode in a Mac OS forensic investigation?

    <p>It provides a quick inspection on-site before transporting the computer</p> Signup and view all the answers

    Which tool can be used in Mac OS forensics to create a bit-level copy of a suspect drive?

    <p>EnCase</p> Signup and view all the answers

    In Mac OS forensics, what command can be used along with netcat to make a forensic copy of a drive?

    <p>dd</p> Signup and view all the answers

    What is the primary benefit of placing the suspect computer into Target Disk Mode during imaging?

    <p>Prevents writing to the source disk</p> Signup and view all the answers

    What differentiates Target Disk Mode from traditional imaging tools like EnCase or Forensic Toolkit in Mac OS forensics?

    <p>Provides a way to preview the computer on-site</p> Signup and view all the answers

    Which option correctly describes the process of connecting to a suspect computer in Target Disk Mode?

    <p>Connect with USB or FireWire for imaging the disk</p> Signup and view all the answers

    What is the purpose of using the ls -al command in a Mac OS forensic examination?

    <p>To list all the files in virtual memory along with program launch details</p> Signup and view all the answers

    Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

    <p>ls/dev/disk?</p> Signup and view all the answers

    In Mac OS forensics, what information can be obtained using the system_profiler SPHardwareDataType command?

    <p>Hardware information of the host system</p> Signup and view all the answers

    Which directory in Mac OS is particularly important to check for user accounts and associated files during a forensic investigation?

    <p>/private/var/audit</p> Signup and view all the answers

    What type of information does the date command provide in a Mac OS forensic examination?

    <p>Current date and time zone</p> Signup and view all the answers

    Why is it essential to know the partitions recognized by a Mac machine upon boot-up in a forensic examination?

    <p>To understand the storage allocation blocks on the device</p> Signup and view all the answers

    What is the purpose of using the ls -al command in a Mac OS forensic examination?

    <p>To list all files in the virtual memory folder along with additional details</p> Signup and view all the answers

    What information does the date command provide in a forensic examination on a Mac OS?

    <p>Current date and time of the system</p> Signup and view all the answers

    Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

    <p>ls /dev/disk?</p> Signup and view all the answers

    Why is it important to document the information from the ls /dev/disk? command before shutting down a Mac system for transport to a forensic lab?

    <p>To identify mounted devices on the system</p> Signup and view all the answers

    What type of information does the system_profiler SPHardwareDataType command return in a forensic examination on a Mac OS?

    <p>Hardware information for the host system</p> Signup and view all the answers

    In Mac OS forensics, what does the grep search tool allow an examiner to do in the virtual memory folder?

    <p>Search for specific files based on content</p> Signup and view all the answers

    Which folder in Mac OS contains the swap file/virtual memory?

    <p>/var/vm/</p> Signup and view all the answers

    How can a forensic examiner check the partitions recognized by a Mac machine upon boot-up?

    <p><code>ls /dev/disk?</code> command</p> Signup and view all the answers

    What is a significant advantage of using shell commands in Mac OS forensic examinations?

    <p>To retrieve information from virtual memory</p> Signup and view all the answers

    What does the hdiutil partition /dev/disk0 command primarily help in listing during a forensic examination of a Mac system?

    <p>Boot drive partition table</p> Signup and view all the answers

    What is a critical step to remember when mounting a forensic image as a VM?

    <p>Mount it as read-only</p> Signup and view all the answers

    Which software mentioned allows the creation of a VM from a forensic image?

    <p>OSForensics version 4</p> Signup and view all the answers

    In Mac OS forensics, what is the purpose of converting a forensic image to a VM?

    <p>To maintain data integrity and prevent modifications</p> Signup and view all the answers

    Which tool allows mounting forensic images as read-only VMs using the VM of your choice?

    <p>Forensic Explorer</p> Signup and view all the answers

    What technique is recommended to examine directories and execute BASH commands in Mac OS forensics when standard tools are insufficient?

    <p>Creating a read-only VM from the forensic image</p> Signup and view all the answers

    More Like This

    Are You Ready for Mac OS Ventura?
    3 questions

    Are You Ready for Mac OS Ventura?

    BoundlessVerdelite avatar
    BoundlessVerdelite
    Mac OS: Security, Reliability, and Efficiency Quiz
    5 questions

    Mac OS: Security, Reliability, and Efficiency Quiz

    GratefulIndicolite avatar
    GratefulIndicolite
    Mac OS Security and Compatibility Quiz
    33 questions

    Mac OS Security and Compatibility Quiz

    UnmatchedMandolin avatar
    UnmatchedMandolin
    Mac OS Environment Setup
    10 questions

    Mac OS Environment Setup

    DeadOnNeon avatar
    DeadOnNeon
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser