nerdexam
GIAC

GPEN · Question #333

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the h

The correct answer is B. Mac OS. When conducting forensic investigation of an iPod, Mac OS provides the most native and comprehensive access to Apple device file systems and forensic tooling.

Penetration Testing Foundations & Reconnaissance

Question

Adam works as a professional Computer Hacking Forensic Investigator. He works with the local police. A project has been assigned to him to investigate an iPod, which was seized from a student of the high school. It is suspected that the explicit child pornography contents are stored in the iPod. Adam wants to investigate the iPod extensively. Which of the following operating systems will Adam use to carry out his investigations in more extensive and elaborate manner?

Options

  • AWindows XP
  • BMac OS
  • CMINIX 3
  • DLinux

How the community answered

(34 responses)
  • A
    9% (3)
  • B
    82% (28)
  • C
    3% (1)
  • D
    6% (2)

Why each option

When conducting forensic investigation of an iPod, Mac OS provides the most native and comprehensive access to Apple device file systems and forensic tooling.

AWindows XP

Windows XP lacks native HFS+ file system support and does not include built-in forensic tools designed specifically for Apple device structures.

BMac OSCorrect

iPods use Apple's HFS+ file system, which Mac OS natively supports without third-party drivers, enabling direct and complete file system access during forensic analysis. Mac OS also hosts the iTunes ecosystem and Apple-specific forensic utilities that are optimized for extracting data, recovering deleted files, and analyzing metadata from Apple devices. This native compatibility makes Mac OS the most thorough and elaborate platform for iPod investigations.

CMINIX 3

MINIX 3 is a minimalist academic research operating system with no forensic investigation tooling or Apple device support.

DLinux

Linux can mount HFS+ volumes with additional packages but lacks the native Apple ecosystem integration and proprietary forensic tools available on Mac OS.

Concept tested: Digital forensic investigation of Apple mobile devices

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-101r1.pdf

Topics

#digital forensics#iPod investigation#Mac OS#forensic tools

Community Discussion

No community discussion yet for this question.

Full GPEN Practice