Computer Hacking Forensic Investigator (CHFI v10) — Question 416

An investigator is tasked with analyzing metadata from a suspected MAC system in a case of data theft. They have decided to parse the Spotlight database file, store.db. Which of the following tools and steps would be most effective for obtaining recently accessed file details from this MacOS system?

Answer options

• A. Running the spotlight_parser Python script on the store.db file to extract file metadata
• B. Using the OS X Auditor to hash artifacts on the running system
• C. Implementing the Stellar Data Recovery Professional for Mac to recover lost or deleted data
• D. Utilizing Memoryze for the Mac to analyze the memory images of the Mac machine

Correct answer: A

Explanation

The correct answer is A because the spotlight_parser Python script is specifically designed to extract file metadata from the Spotlight database, making it the most effective method for obtaining details about recently accessed files. Options B, C, and D do not directly address the need to analyze the store.db file for metadata; B focuses on hashing, C is for data recovery, and D is about memory analysis.