nerdexam
GIAC

GCIA · Question #103

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the h

The correct answer is B. Mac OS. Mac OS provides native support for the HFS+ file system used by Apple iPods, making it the most capable OS for comprehensive iPod forensic examination. Other operating systems require third-party drivers or lack native iPod integration.

Network Forensics, Protocol Insecurity & Evasion Techniques

Question

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options

  • ALinux
  • BMac OS
  • CMINIX 3
  • DWindows XP

How the community answered

(55 responses)
  • A
    5% (3)
  • B
    78% (43)
  • C
    4% (2)
  • D
    13% (7)

Why each option

Mac OS provides native support for the HFS+ file system used by Apple iPods, making it the most capable OS for comprehensive iPod forensic examination. Other operating systems require third-party drivers or lack native iPod integration.

ALinux

Linux can mount HFS+ volumes but historically required third-party kernel modules and has limited write support, reducing the depth of forensic access.

BMac OSCorrect

iPods formatted with HFS+ are natively read and written by Mac OS without any additional drivers, and Apple's own forensic-relevant tools (Disk Utility, file system libraries) provide full access to the iPod's directory structure, deleted file remnants, and metadata. This native compatibility allows a forensic investigator to conduct a more extensive and thorough examination compared to other platforms.

CMINIX 3

MINIX 3 is a microkernel research OS with minimal hardware support and no native iPod/HFS+ forensic tooling.

DWindows XP

Windows XP cannot natively read HFS+ formatted iPods and would require third-party software, limiting the scope of the investigation.

Concept tested: iPod forensic investigation using native OS support

Source: https://support.apple.com/guide/disk-utility/welcome/mac

Topics

#digital forensics#mobile device forensics#iPod investigation#forensic OS

Community Discussion

No community discussion yet for this question.

Full GCIA Practice