For productivity application analysis, how can forensic examiners utilize metadata from Calendar events?

• A. To determine device orientation
• B. To understand user's time management
• C. To assess graphic design preferences
• D. To gauge Internet speed

What does an analysis of iCloud data NOT typically provide?

• A. Device backups
• B. Shared document edits
• C. Encrypted data content
• D. Application usage statistics

What can be inferred from analyzing the configuration of a Mail application?

• A. Graphics card performance
• B. Number of installed browsers
• C. Processor architecture
• D. User's communication habits and contacts

You are investigating a macOS device that shows signs of compromise, including abnormal network activity and unauthorized system modifications.
What steps should you take to gather evidence of the malware's presence and determine how it compromised the system? (Choose three)

• A. Capture memory dumps to analyze volatile data
• B. Use ps -A to identify unusual processes running in the background
• C. Reboot the system to restore normal functionality
• D. Inspect the /Library/LaunchDaemons/ directory for malicious startup items
• E. Check /var/log/system.log for suspicious activity

What type of artifact is crucial to identify when examining systems for signs of malicious code?

• A. Network configurations
• B. User preferences
• C. Application logs
• D. Unusual executable files