Chapter 10
The __________ is used primarily with computers that have an Intel-based processor. It requires Mac OS X v10.4 or later.
GUID Partition Table
On a Macintosh, the __________ folder contains information about system and software updates.
/Library/Receipts
On a Macintosh, the __________ directory contains information about servers, network libraries, and network properties.
/Network
On a Macintosh, the __________ folder maintains the preferences of programs that have been deleted.
/Users/<user>/Library/Preferences/
On a Macintosh, the _________ directory contains information about mounted devices.
/Volumes
On a Macintosh, the __________ directory is where configuration files are located.
/etc
If you need to know what documents have been printed from a Macintosh, the __________ folder can give you that information.
/var/spool/cups
In__________, Steve Wozniak and Steve Jobs finished the prototype of the first Apple computer.
1975
The Apple I had a built-in video terminal and sockets for __________ kilobytes of onboard random access memory (RAM).
8
When Apple released the Macintosh in 1984, it had a __________ megahertz Motorola processor.
8
The _________ is used with any PowerPC-based Mac. Intel-based Macs can mount and use a drive formatted with this, but cannot boot from the device. PowerPC-based Macs can both mount and use a drive formatted with this, and can also use it as a start-up device.
Apple Partition Map
__________ is the process whereby the file system keeps a record of what file transactions take place so that in the event of a hard drive crash, the files can be recovered.
Journaling
The release of __________, was meant to be more in synch with the style of other Apple systems, such as iOS and WatchOS.
Mac OS X 10.7 in 2011, called Lion
The release of _____________, had over 300 new features, support for Intel x86 chips, and support for the new G3 processor.
Mac OS X v10.5 in 2007, called Leopard
Priyanka is a forensic investigator. She is at an office where a Macintosh computer was used in a suspected crime. The computer is still running. Priyanka wants to image the disk before transporting the computer to the forensic lab. She also wants to avoid accidentally altering information on the computer's hard disk. What should she do first?
Put the computer in Target Disk Mode.
Apple Computer's three founders were Steve Jobs, Steve Wozniak, and __________ .
Ronald Wayne
In Mac OS X, the __________ shell command lists the current device files that are in use.
ls /dev/disk?
In Mac OS X, the __________ shell command returns the hardware information for the host system. This provides information useful for the basic documentation of the system prior to beginning your forensic examination.
system_profiler SPHardwareDataType
In Mac OS X, the __________ shell command returns information about the operating system.
system_profiler SPSoftwareDataType
On a Macintosh, in the __________ folder, you will find a subfolder named app profile. This contains lists of recently opened applications as well as temporary data used by applications.
var/vm
