Chapter 17 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. Commit to an answer before you scroll — a guess you have to defend teaches more than a peek.

Multiple choice

Q1. Since macOS 10.13 "High Sierra," the default file system on every Mac is a copy-on-write file system. Which is it? - A) HFS+ - B) APFS - C) NTFS - D) ext4

Q2. Why does a file a user "deleted" this morning often still exist, whole and mountable, in an APFS snapshot? - A) macOS keeps a hidden Trash that is never emptied - B) Because APFS is copy-on-write, old blocks are not overwritten in place, and a snapshot pins them at a transaction id - C) The file is re-downloaded automatically from iCloud - D) Snapshots store an encrypted compressed backup of every file

Q3. A knowledgeC.db timestamp reads 758661482. To convert Apple "Mac absolute time" to a Unix timestamp, you must add 978307200 — because Apple counts seconds from which epoch? - A) 1601-01-01 (the Windows FILETIME epoch) - B) 1970-01-01 (the Unix epoch) - C) 2001-01-01 (the Cocoa/Mac absolute epoch) - D) 1904-01-01 (the classic Mac OS epoch)

Q4. Which macOS artifact most directly records, with an authoritative timestamp, the URL a file was downloaded from and the page it was linked from? - A) FSEvents - B) The Keychain - C) QuarantineEventsV2 (with the com.apple.quarantine xattr) - D) /var/log/system.log

Q5. What is the single most important caution about FSEvents records? - A) They are encrypted and require the user's password - B) They do not carry per-event wall-clock timestamps — the event IDs are a strictly increasing counter, not a clock - C) They are deleted on every reboot - D) They record only network activity, not file changes

Q6. When collecting the macOS Unified Log from a mounted image, you must collect /var/db/diagnostics/ and which second directory, or you will hold entries you cannot fully render? - A) /var/db/uuidtext/ - B) /var/log/ - C) /private/var/db/CoreDuet/ - D) ~/Library/Keychains/

Q7. On a Debian/Ubuntu Linux system, which binary file records failed login attempts, and which tool decodes it? - A) /var/log/auth.log, read with grep - B) /var/log/wtmp, read with last - C) /var/log/btmp, read with lastb - D) /var/run/utmp, read with who

Q8. Why is deleted-file recovery on ext4 generally harder than on NTFS? - A) ext4 encrypts every file by default - B) ext4 overwrites the file's data blocks with zeros immediately on deletion - C) At deletion ext4 zeroes the inode's extent (block) map, so the inode no longer knows where its data was — whereas an NTFS MFT record typically retains its data-run pointers - D) ext4 stores no metadata about files at all

Q9. A file was rm'd on ext4 an hour ago and the live inode's block map is gone. What is your best second chance at reconstructing that block map? - A) The $Recycle.Bin - B) The jbd2 journal, which often holds older copies of the inode table (recovered with ext4magic) - C) The Windows registry - D) Spotlight's store.db

Q10. When a row is "deleted" from a SQLite database, where does its content typically linger until overwritten or VACUUM'd? - A) In the operating system's swap file only - B) As a freeblock in the page's unallocated area (and freed pages join the freelist), plus possibly in the -wal - C) It is securely shredded immediately - D) In a hidden deleted_rows table

True / False

Q11. Each FSEvents record includes a precise wall-clock timestamp for the moment the file change occurred. (True / False)

Q12. The systemd journal can be read offline, directly from a mounted forensic image, using journalctl --file (or -D) with structured field filters. (True / False)

Short answer

Q13. You are collecting a SQLite database (say, knowledgeC.db) for analysis. In one or two sentences: which two sidecar files must you collect alongside it, and what can the -wal contain that analyzing the main .db alone would miss?

Q14. Name the three independent Linux sources that can each record the same SSH login session, and explain in one sentence why having three matters when one of them has been tampered with.

---

Answer key

Q1 — B. APFS (the Apple File System) replaced HFS+ as the default in macOS 10.13 (2017); its copy-on-write design is what makes snapshots forensic gold.

Q2 — B. Under copy-on-write, changed data is written to fresh blocks and the old blocks are simply unreferenced; a snapshot pins the old tree at a transaction id so those blocks are not freed — a fully navigable copy of the volume as it was.

Q3 — C. Mac absolute time counts seconds from the Cocoa epoch of 2001-01-01 00:00:00 UTC; 978307200 is the Unix timestamp of that instant. (758661482 + 978307200 = 1736968682 = 2025-01-15 14:18:02 EST.)

Q4 — C. QuarantineEventsV2 (table LSQuarantineEvent) holds the download URL, the originating page, the agent, and a Mac-absolute-time timestamp; the com.apple.quarantine xattr on the file keys into it by UUID. Spotlight's kMDItemWhereFroms corroborates but Quarantine is the authoritative download record.

Q5 — B. FSEvents event IDs are a monotonic counter, not a clock; you get strict order from the IDs and approximate time by correlating with the gzip file's mtime and timestamped sources (Unified Log, Spotlight, knowledgeC).

Q6 — A. The Unified Log stores format strings and static text separately in /var/db/uuidtext/; without it, .tracev3 entries cannot be fully rendered. (log collect produces a complete .logarchive that avoids the split.)

Q7 — C. /var/log/btmp holds failed login attempts and is decoded with lastb. wtmp/last is the historical success record; utmp/who is who is logged in now.

Q8 — C. ext4 invalidates the extent tree at deletion, zeroing the block map in the inode — so the data blocks may persist but the map to them is gone. NTFS typically retains the data runs, which is why NTFS undelete is often easy and ext4 undelete is not.

Q9 — B. The jbd2 journal frequently contains older copies of the inode table and directory blocks — including the inode from before deletion, extent tree intact. ext4magic mines it; extundelete predates extents and is weaker on them.

Q10 — B. Deleted rows become freeblocks within their page (and whole freed pages join the freelist), retaining their content until reused; VACUUM is what actually destroys them. The -wal may also hold superseded page versions.

Q11 — False. FSEvents records carry no per-event wall-clock timestamp; the event IDs establish order only. Time must be approximated by correlation.

Q12 — True. journalctl --file ./path/to/system.journal (or -D ./journaldir) reads journal files straight from a mounted image, with rich filtering on _PID, _UID, _COMM, _SYSTEMD_UNIT, _BOOT_ID, and time windows.

Q13. Collect the -wal (write-ahead log) and -shm (shared-memory) files alongside the .db. The -wal holds page versions not yet checkpointed back into the main database — which means it can contain both the newest changes and superseded older versions of pages, so analyzing the .db alone can miss the most recent and most recently deleted activity.

Q14. auth.log (text), wtmp (binary, read with last), and the systemd journal each record the SSH session. When they agree the finding is bulletproof; when one is missing or edited and the others are not, the disagreement is itself affirmative evidence of tampering — so three watchers beat one.

Scoring: 13–14 — cross-platform and courtroom-ready; you can defend each artifact and its limits. 10–12 — solid; revisit the Mac-absolute-time correction and the ext4-vs-NTFS deletion contrast. 7–9 — re-read "macOS metadata and activity artifacts" and "ext4 under the hood," then redo Groups C and F in the exercises. Below 7 — re-read the chapter index and rebuild the worked-example timeline before moving on.