Mac Basics for Forensics

Which operating system was developed as a replacement for Apple DOS 3.3 and had more support for programming, including assembly and BASIC?

What was the name of the first edition of the Apple DOS released in 1978?

Which Apple II model was the first to feature color graphics in a plastic case with a built-in keyboard?

What was the acronym SOS in Apple SOS operating system stood for?

Which Apple II model was released as a 16-bit computer, unlike its predecessors which were 8-bit?

Which operating system had a full graphical user interface with a file browser navigated with mouse clicks?

What is the main reason many forensic examiners lack a good working knowledge of Mac OS systems?

Who were the three founders of Apple Computer?

What was the first computer created by Wozniak for Apple Computer?

Which company originally had the right of first refusal on any new inventions by Steve Wozniak?

How fast was the 8-bit microprocessor in the first Apple computer running?

What technology did Steve Wozniak's employment contract with Hewlett-Packard lead to being released to him?

What was the main change with the introduction of Mac OS X?

Which product introduced by Apple did not perform well in the market and was discontinued in 1997?

What was the operating system for the Macintosh computer initially released by Apple in January 1984?

Which processor speed did the Macintosh have when it was released in January 1984?

What distinguished the Macintosh II from its predecessor, the Macintosh?

In what year did Apple release the Apple Network Server with a variation of the IBM AIX system?

When did Apple change the operating system brand name to macOS?

Which Mac OS version introduced Handoff, allowing interaction between iPhones and Mac OS computers?

What was the main focus of Mac OS X 10.6, Snow Leopard, upon its release in 2009?

Which Mac OS version was the last to be named after animals?

What was one significant change in Mac OS X v10.7, Lion, regarding its interface?

Which Mac OS version allowed users to complete unfinished iPhone emails on their Mac OS computer?

What technology supported by Big Sur helps ease the transition to Apple's silicon processor architecture?

Which Mac OS version included built-in support for iCloud to support cloud computing?

Which file system used concepts from the SOS operating system designed for the Apple III?

Which file system introduced to support Apple's new hard drive in 1985?

Which file system supported filenames of up to 255 characters, unlike the DOS system?

Which file system was an enhancement of the HFS file system?

Which file system replaced the HFS file system with Mac OS 8.1?

Which file system feature keeps a record of file transactions to aid in file recovery after a crash?

What type of link in HFS+ is an inode linking directly to a specific file?

Which file system uses Unicode for file naming information encoding?

When does an HFS+ file get defragmented upon opening?

What storage system used in HFS+ keeps track of free and in-use allocation blocks?

Which Mac OS feature allows execution of Linux commands through a BASH shell prompt?

In HFS+, what is a significant difference compared to HFS regarding allocation blocks?

What file system is used by DVD-ROM discs?

What is a key feature of APFS in comparison to HFS+?

Which partition scheme is used primarily with computers that have an Intel-based processor?

Which file system is associated with CDs?

What utility allows one to install additional operating systems alongside Mac OS in a nondestructive manner?

What type of drive partition can Mac OS read with read-only support?

What does the Apple Partition Map work with?

Which Apple device is likely to use APFS as its file system?

Which partition scheme requires OS X v10.4 or later?

Which file system has specific extensions developed by Apple?

What should you not create if the system is using APFS according to the text?

In Mac OS, support for which file system allows reading floppy disks?

What type of information can be found in the /var/spool/cups folder in Mac OS logs?

Which log in Mac OS provides data on all mounted volumes, including the dates they were mounted?

In Mac OS, which folder can give information about devices that have been attached and data from them?

What is the significance of the /private/var/audit logs in Mac OS forensics?

Which log directory in Mac OS is similar to Linux file structures due to its FreeBSD base?

Why is checking logs considered one of the first steps in any forensic examination?

Where can important forensic data be found in Mac OS audit logs?

Which folder in Mac OS contains user preferences, including preferences of deleted programs?

In which folder of Mac OS can you find lists of recently opened applications and temporary data used by applications?

Where would you look to find items saved to iCloud in Mac OS?

Which folder in Mac OS is less useful for forensic investigation but can indicate if a patch was applied and when?

Where can you find a log showing a variety of commands executed in the terminal window of Mac OS?

Where can a forensic examiner find information about mounted devices in Mac OS?

Which Mac OS directory should a forensic examiner check primarily for user accounts and associated files?

In a forensic examination of a Mac machine, where would an examiner look for network properties and servers information?

Which Mac OS directory is particularly important to check in cases involving malware?

Where are configuration files typically located in a Mac OS system that could be of interest in a forensic investigation?

If an examiner needs data regarding mounted devices like CDs and external disks in Mac OS, which directory should they explore?

Where is the network configuration data for each network card stored in Mac OS?

Which Mac OS directory is essential for examining user accounts and associated files?

Where can an examiner find information about servers, network libraries, and network properties in Mac OS?

In which Mac OS directory are configuration files located, often manipulated by cybercriminals?

Where does an examiner need to look to find information on mounted devices like CDs and external disks in Mac OS?

Which directory in Mac OS stores applications and is particularly critical to check in cases involving malware?

What is one advantage of using Target Disk Mode in a Mac OS forensic investigation?

Which tool can be used in Mac OS forensics to create a bit-level copy of a suspect drive?

In Mac OS forensics, what command can be used along with netcat to make a forensic copy of a drive?

What is the primary benefit of placing the suspect computer into Target Disk Mode during imaging?

What differentiates Target Disk Mode from traditional imaging tools like EnCase or Forensic Toolkit in Mac OS forensics?

Which option correctly describes the process of connecting to a suspect computer in Target Disk Mode?

What is the purpose of using the ls -al command in a Mac OS forensic examination?

Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

In Mac OS forensics, what information can be obtained using the system_profiler SPHardwareDataType command?

Which directory in Mac OS is particularly important to check for user accounts and associated files during a forensic investigation?

What type of information does the date command provide in a Mac OS forensic examination?

Why is it essential to know the partitions recognized by a Mac machine upon boot-up in a forensic examination?

What is the purpose of using the ls -al command in a Mac OS forensic examination?

What information does the date command provide in a forensic examination on a Mac OS?

Which command should a forensic examiner use to list the device files that are currently in use on a Mac machine?

Why is it important to document the information from the ls /dev/disk? command before shutting down a Mac system for transport to a forensic lab?

What type of information does the system_profiler SPHardwareDataType command return in a forensic examination on a Mac OS?

In Mac OS forensics, what does the grep search tool allow an examiner to do in the virtual memory folder?

Which folder in Mac OS contains the swap file/virtual memory?

How can a forensic examiner check the partitions recognized by a Mac machine upon boot-up?

What is a significant advantage of using shell commands in Mac OS forensic examinations?

What does the hdiutil partition /dev/disk0 command primarily help in listing during a forensic examination of a Mac system?

What is a critical step to remember when mounting a forensic image as a VM?

Which software mentioned allows the creation of a VM from a forensic image?

In Mac OS forensics, what is the purpose of converting a forensic image to a VM?

Which tool allows mounting forensic images as read-only VMs using the VM of your choice?

What technique is recommended to examine directories and execute BASH commands in Mac OS forensics when standard tools are insufficient?