nerdexam
GIAC

GPEN · Question #193

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the…

The correct answer is D. Mac OS. Mac OS is the native operating system for iPods, giving forensic investigators direct access to the HFS+ file system without conversion or compatibility layers.

Penetration Testing Foundations & Reconnaissance

Question

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options

  • AMINIX 3
  • BLinux
  • CWindows XP
  • DMac OS

How the community answered

(38 responses)
  • A
    5% (2)
  • B
    8% (3)
  • C
    3% (1)
  • D
    84% (32)

Why each option

Mac OS is the native operating system for iPods, giving forensic investigators direct access to the HFS+ file system without conversion or compatibility layers.

AMINIX 3

MINIX 3 is a microkernel research OS with no native HFS+ support and no forensic tooling ecosystem for Apple devices.

BLinux

Linux requires third-party HFS+ drivers that may not support all features or journaling states, reducing the completeness of the investigation.

CWindows XP

Windows XP has no native HFS+ support and would require additional drivers, risking file system alterations that could compromise forensic integrity.

DMac OSCorrect

iPods use Apple's HFS+ file system, which Mac OS supports natively. A forensic investigator using Mac OS can mount the iPod directly, access all partitions including hidden and system areas, and use Apple-native forensic utilities without risking file system translation errors that could corrupt evidence. This native compatibility makes the investigation more thorough and legally defensible.

Concept tested: Native HFS+ support for iPod forensic investigation

Source: https://support.apple.com/guide/disk-utility/file-system-formats-dsku19ed921c/mac

Topics

#digital forensics#mobile device forensics#Mac OS#forensic tools

Community Discussion

No community discussion yet for this question.

Full GPEN Practice