What was the most important forensic feature in OSX 10.10?

What was the most important forensic feature in OSX 10.10?

• A. Handoff
• B. Continuity
• C. AirDrop
• D. Spotlight

Answer: (A)

The main idea being tested is how features that connect your Mac with other devices leave usable traces that help reconstruct what a user did and when. Handoff is the feature that stands out here because it lets an activity started on one device be picked up and continued on another. On OSX 10.10 Yosemite, Handoff relies on iCloud, Bluetooth Low Energy, and Wi‑Fi to pass the state of an app from a phone or tablet to the Mac, creating cross‑device activity evidence. In a forensic investigation, this yields concrete artifacts such as timestamps, device identifiers, and records of which app state was handed off, showing that a user began something on one device and resumed it on the Mac. That cross‑device trail is highly valuable for establishing user presence and behavior across devices within a timeframe. AirDrop, while useful for transferring files, tends to be more transient and file‑transfer–level evidence. Spotlight provides indexing and search data but doesn’t inherently tie together user sessions across devices. Continuity is the broader umbrella that includes several features, but the most actionable forensic signal for linking device activity across platforms is the Handoff behavior itself.

The main idea being tested is how features that connect your Mac with other devices leave usable traces that help reconstruct what a user did and when. Handoff is the feature that stands out here because it lets an activity started on one device be picked up and continued on another. On OSX 10.10 Yosemite, Handoff relies on iCloud, Bluetooth Low Energy, and Wi‑Fi to pass the state of an app from a phone or tablet to the Mac, creating cross‑device activity evidence. In a forensic investigation, this yields concrete artifacts such as timestamps, device identifiers, and records of which app state was handed off, showing that a user began something on one device and resumed it on the Mac. That cross‑device trail is highly valuable for establishing user presence and behavior across devices within a timeframe.

AirDrop, while useful for transferring files, tends to be more transient and file‑transfer–level evidence. Spotlight provides indexing and search data but doesn’t inherently tie together user sessions across devices. Continuity is the broader umbrella that includes several features, but the most actionable forensic signal for linking device activity across platforms is the Handoff behavior itself.