Last Day to Save $400 on 4-6 Day Courses at SANS Cyber Defense Initiative 2017!

FOR518: Mac Forensic Analysis

The most comprehensive Mac class I've taken.

Daniel Mills, NASA

Best of any course I've ever taken. I love the idea of being able to bring home and review.

Eric Koebelen, Incident Response US

Digital forensic investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iDevice? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms, yet most investigators are familiar with Windows-only machines.

Times and trends change and forensic investigators and analysts need to change with them. The new FOR518: Mac Forensic Analysis course provides the tools and techniques necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis skills taught in the course will enable Windows-based investigators to broaden their analysis capabilities and have the confidence and knowledge to comfortably analyze any Mac or iOS system.

FORENSICATE DIFFERENTLY!

FOR518: Mac Forensic Analysis will teach you:

  1. Mac and iOS Fundamentals: How to analyze and parse the Hierarchical File System (HFS+) by hand and recognize the specific domains of the logical file system and Mac-specific file types.
  2. User Activity: How to understand and profile users through their data files and preference configurations.
  3. Advanced Analysis and Correlation: How to determine how a system has been used or compromised by using the system and user data files in correlation with system log files.
  4. Apple Technologies: How to understand and analyze many Mac and iOS specific technologies, including Time Machine, Spotlight, iCloud, Document Versions, FileVault, Continuity, and FaceTime.

FOR518: Mac Forensic Analysis course aims to form a well-rounded investigator by introducing Mac and iOS forensics into a Windows-based forensics world. This course focuses on topics such as the HFS+ file system, Mac-specific data files, tracking of user activity, system configuration, analysis and correlation of Mac logs, Mac applications, and Mac-exclusive technologies. A computer forensic analyst who successfully completes the course will have the skills needed to take on a Mac or iOS forensics case.

More

  • Parse the HFS+ file system by hand, using only a cheat sheet and a hex editor.
  • Determine the importance of each file system domain.
  • Conduct temporal analysis of a system by correlating data files and log analysis.
  • Profile how individuals used the system, including how often they used the system, what applications they frequented, and their personal system preferences.
  • Determine remote or local data backups, disk images, or other attached devices.
  • Find encrypted containers and FileVault volumes, understand keychain data, and crack Mac passwords.
  • Analyze and understand Mac metadata and their importance in the Spotlight database, Time Machine, and Extended Attributes.
  • Develop a thorough knowledge of the Safari Web Browser and Apple Mail applications.
  • Identify communication with other users and systems though iChat, Messages, FaceTime, Remote Login, Screen Sharing, and AirDrop.
  • Conduct an intrusion analysis of a Mac for signs of compromise or malware infection.
  • Acquire and analyze memory from Mac systems.
  • Acquire iOS and analyze devices in-depth.

  • In-Depth HFS+ File System Examination
  • File System Timeline Analysis
  • Advanced Computer Forensics Methodology
  • Mac-Specific Acquisition and Incident Response Collection
  • Mac Memory Acquisition and Analysis
  • File System Data Analysis
  • Metadata Analysis
  • Recovery of Key Mac Files
  • Volume and Disk Image Analysis
  • Analysis of Mac Technologies, including Time Machine, Spotlight, and FileVault
  • Advanced Log Analysis and Correlation
  • iDevice Analysis and iOS Artifacts

Hide

Notice:

For multi-course live training events, there will be a set-up time from 8:00-9:00 a.m. on the first day to make sure that computers are configured correctly and thus make the most of class time. All students are strongly encouraged to attend. For laptop set up requirements click here

Course Syllabus

Overview

This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully and easily collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.

Exercises
  • Exercise Setup
  • BlackLight and Image Mounting
  • Disks and Partitions
  • Exploring iOS Acquisitions

CPE/CMU Credits: 6

Topics

Apple Essentials

  • Mac and iOS Systems
  • Mac Analysis in a Windows World
  • Apple Fundamentals

Mac Essentials and Acquisition

  • Mac File System Domains
  • Mac Directory Structures
  • Containers and Sandboxes
  • Acquisition Pitfalls and Considerations
  • Hard Drive, Network, and Memory Acquisition Tools

Disks & Partitions

  • Disk Layout
  • Partition Schemes
  • GPT
  • FileVault
  • Disk Images
  • CoreStorage
  • Bootcamp
  • Fusion Drives
  • Image Mounting Using Open-Source Utilities

iOS Essentials

  • Differences of iOS and macOS
  • Security and Encryption
  • Jailbreaks

iOS Acquisition

  • Types and Differences
  • Tools for Acquisition and Analysis
  • Passcode Bypass and Cracking

iOS Backups

  • Local and iCloud Backups
  • Cracking Backups
  • Analysis Tools

Overview

The building blocks of Mac and iOS forensics start with a thorough understanding of the HFS+. Utilizing a hex editor, students will learn the basic principles of the primary file system implemented on Mac OS X systems. The students will then use that information to look at a variety of great artifacts that use the file system and that are different than other operating systems students have seen in the past. Rounding out the day, students will review Mac and iOS triage data.

Exercises
  • HFS+
  • File System Fun!
  • Mac and iOS Triage

CPE/CMU Credits: 6

Topics

HFS+ File System

  • Overview
  • Data Structures
  • Manual Parsing
  • Tool Output and Caveats

Extended Attributes

  • Contents
  • Analysis
  • Interesting Attributes

File System Events Store Database

  • Usage
  • Parsing with Tools
  • Practical Analysis

Spotlight

  • Analysis Methods and Tools
  • Practical Queries

Portable Artifacts

  • Artifacts Left Behind by Macs

Mac and iOS Triage

  • OS Version
  • Identifying Data
  • Installation
  • Network
  • Time Zone
  • User Accounts

Most Recently Used (MRU)

  • Recent iOS Apps
  • Recent Folders
  • Recent Applications
  • Recent Documents
  • Recent Servers
  • Recent Files
  • Parsing Methods and Tools

Overview

This section contains a wide array of information that can be used to profile and understand how individuals use their computers. The logical Mac file system is made up of four domains; User, Local, System, and Network. The User Domain contains most of the user-related items of forensic interest. This domain consists of user preferences and configurations.

The System and Local Domains contain system-specific information such as application installation, system settings and preferences, and system logs. This section details basic system information, GUI preferences, and system application data. A basic analysis of system logs can give a good understanding of how a system was used or abused.

Timeline analysis tells the story of how the system was used. Each entry in a log file has a specific meaning and may be able to tell how the user interacted with the computer. The log entries can be correlated with other data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently. Analysis tools and techniques will be used to correlate the data and help the student put the story back together in a coherent and meaningful way.

Exercises
  • User Data and System Configuration
  • Log Parsing and Analysis
  • Timeline Analysis and Data Correlation

CPE/CMU Credits: 6

Topics

User Data and System Configuration

  • Bash History
  • Keychains
  • Printing
  • Firewall Settings
  • Sharing Settings
  • Bluetooth
  • Autoruns
  • Application Bundles
  • Software Updates
  • GUI Settings

Log Parsing and Analysis

  • Log Basics
  • Log Formats
  • Log Recovery
  • Log Types
  • Analysis and Parsing Tools

Timeline Analysis and Data Correlation

  • Temporal Context and Timestamps
  • Volume Analysis
  • Temporal Changes
  • System Information and State
  • Network Analysis
  • User Access
  • Privilege Escalation
  • Account Creation/Deletion
  • Software Installation
  • Backup Activity
  • Locational Data

Overview

In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, etc. This data can provide analysts with the who, what, where, why, and how for any investigation.

This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.

Exercises
  • Safari and Mail
  • Applications - Part I
  • Applications - Part II

CPE/CMU Credits: 6

Topics

Application Permissions

  • Privacy Settings
  • Location Services

Native Application Fundamentals

  • Locations
  • Snapshots

Safari Browser

  • History
  • Cache
  • Syncing
  • Private Mode
  • Data Retention

Apple Mail

  • Locations and Data Access
  • Mail Accounts and Configuration
  • Attachments
  • Metadata

Communication

  • iChat/Messages
  • FaceTime
  • SMS
  • iMessage
  • Call History
  • Voicemail

Calendar and Reminders

  • Files
  • Database Analysis

Contacts

  • Files
  • Database Analysis

Notes

  • Files
  • Database Analysis
  • Version Differences
  • Media Analysis

Apple Pay, Wallet, Passes

  • Files
  • Database Analysis

Photos

  • Files
  • Database Analysis
  • iCloud Syncing

Maps

  • Files
  • Database Analysis
  • Caveats

Location Data

  • Routine, WiFi, Cellular Locations
  • Files
  • Database Analysis
  • Tools and Parsing

Random Apps

  • iWork
  • Spotlight
  • AirDrop

Apple Watch

  • Files
  • Capabilities
  • Synced Data

Third-Party Apps

  • Locations
  • Analysis Caveats
  • Data Structure
  • Analysis Tools

Overview

Mac systems implement some technologies that are available only to those with Mac and iOS devices. These include data backup with Time Machine, Document Versions, and iCloud; and disk encryption with FileVault. Other advanced topics include data hidden in encrypted containers, live response, Mac intrusion and malware analysis, and Mac memory analysis.

Exercises
  • Live Response
  • Time Machine
  • iCloud and Document Versions
  • Memory Analysis
  • Password Cracking and Encrypted Containers

CPE/CMU Credits: 6

Topics

Live Response

  • Live Triage Techniques
  • Volatile Data Collection

Time Machine

  • Backup Settings
  • Backup Volumes
  • Snapshot Analysis
  • Local Snapshots
  • Encrypted Backups
  • Mounting and Analysis

OS X Malware and Intrusion Analysis

  • Intrusion Analysis
  • Java Cache and IDX Files
  • File Quarantine
  • XProtect
  • Gatekeeper

iCloud

  • Synced Accounts
  • Mobile Documents
  • Synced Preferences

Versions

  • Versions Metadata
  • Versions Database
  • Generations
  • Chunk Storage

Memory Acquisitions and Analysis

  • Acquisition Tools
  • Analysis Tools

Password Cracking and Encrypted Containers

  • Password Shadow Files
  • Cracking Software
  • Keychains
  • FileVault
  • Encrypted Volumes and Disk Images

Overview

Students will put their new Mac forensics skills to the test by running through a real-life scenario with team members.

Topics:

  • In-Depth HFS+ File System Examination
  • File System Timeline Analysis
  • Advanced Computer Forensics Methodology
  • Mac Memory Analysis
  • File System Data Analysis
  • Metadata Analysis
  • Recovering Key Mac Files
  • Volume and Disk Image Analysis
  • Analysis of Mac Technologies including Time Machine, Spotlight, and FileVault
  • Advanced Log Analysis and Correlation
  • iDevice Analysis and iOS Artifacts

CPE/CMU Credits: 6

Additional Information

!! IMPORTANT - BRING YOUR OWN SYSTEM CONFIGURED USING THESE DIRECTIONS !!

Mac System Setup Guide: is https://www.sans.org/security-resources/FOR518-laptop-setup-guide-v1-8.pdf

It is critical that you follow the pre-class setup guide for your Mac found here: is https://www.sans.org/security-resources/FOR518-laptop-setup-guide-v1-8.pdf This pre-class Mac system setup guide is crucial to follow prior to attending class the first day. The guide is a detailed step-by-step walk-through of a variety of downloads and configuration steps needed to prep your system for an in-depth and exciting week of Mac forensics. Please follow all of the steps correctly; otherwise your enjoyment of the class could be impacted. We recommend setting up your system at home, as hotel Internet might not be adequate to finalize the setup prior to class. Please do not wait until the night before class to follow the setup guide.

A properly configured Mac system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

MANDATORY FOR518 SYSTEM HARDWARE AND SOFTWARE REQUIREMENTS:

Apple Mac laptop with the following minimum configuration:

  • Mac OS/OS X 10.7 or newer
  • CPU: Intel Core i5/i7 Series (a high-end Intel 2.8Ghz+ Core 2 Duo may also suffice)
  • Wireless 802.11 Capability
  • 8GB RAM or more is recommended
  • 200 gigabytes of free space on your system hard drive, or external hard drive.
  • USB 2.0 port(s) or higher (Please bring your USB-C to USB-A adapters for the new Macs!)
  • Students should have the capability to have Local Administrator Access within their host operating system. Some monitoring and AV software may interfere with some exercises, so please be able to turn these off when needed.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

  • Experienced Digital forensics Analyssts who want to solidify and expand their understanding of file system forensics and advanced Mac analysis
  • Law Enforcement Officers, Federal Agents, and Detectives who want to master advanced computer forensics and expand their investigative skill set.
  • Media Exploitation Analysts who need to know where to find the critical data they need from a Mac system.
  • Incident Response Team Members who are responding to complex security incidents/intrusions from sophisticated adversaries and need to know what to do when examining a compromised system.
  • Information Security Professionals who want to become knowledgeable with Mac OS X and iOS system internals.
  • SANS FORR500 (formerly FOR408), FOR508, FOR526, FOR610, and FOR585 Alumni looking to round out their forensic skills.

A working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

http://rik.smith-unna.com/command_line_bootcamp

https://www.learnenough.com/command-line-tutorial

  • 90-Day Trial for BlackBag Technologies BlackLight Forensic Analysis Software
  • The book OS X Incident Response: Scripting and Analysis, 1st Edition
  • Course USBs loaded with case examples, tools, and documentation
  • MP3 audio files of the complete course lecture

"Really excellent course. Fantastic resource in the classroom material. Forensic challenge the last day was very fun" - Anonymous

"Best Mac class anywhere." - Eric Koebelen, Incident Response US

"It was very interesting to learn that certain 'forensic' tools could report data as being encrypted even though one could still get other data." - Gary Titus, Stroz Friedberg LLC

"Best course I know about on Mac Forensic. Like the use of mostly 'ghetto' tools." - Anonymous

"Solid background for investigations new to Mac." - Eric Mak, Google

"Best of any course I've ever taken. I love the idea of being able to bring home and review." - Eric Koebelen, Incident Response US

"The depth of time exercise was outstanding. One can tell the amount of work that went into it." - Gary Titus, Stroz Friedberg LLC

"Wow. Sarah is awesome." - Anonymous

"With so much focus on Windows forensics, the Mac class is really necessary." - Paul Sieberth, Tulane University

"I have not encountered a Mac class this in-depth that covers the file structure so well." - Craig Goldsmith, OCSD

"The most comprehensive Mac class I've taken." - Daniel Mills, NASA

"This is the most in-depth Mac class I have attended." - Craig Goldsmith OCSD

Author Statement

"This course is designed to enable an analyst comfortable in Windows-based forensics to perform just as well on the Mac. The Mac market share is an ever-increasing and popular platform for many companies and government entities.

I believe a well-rounded forensic analyst is an extremely well-prepared and employable individual in a Windows forensics world. Windows analysis is the base education in the competitive field of digital forensics. Any additional skills you can acquire can set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis.

Mac forensics is truly a passion of mine that I genuinely want to share with the forensics community. While you may not work on a Mac investigation every day, the tools and techniques you learn in this course will help you with other investigations including Windows, Linux, and mobile." - Sarah Edwards

Additional Resources

Take your learning beyond the classroom. Explore our site network for additional resources related to this course's subject matter.

*CPE/CMU credits not offered for the SelfStudy delivery method

Online options available. Train from any location.

7 Training Results
Type Topic Course / Location / Instructor Date Register

Training Event
Incident Response & Forensics
SANS London February 2018
London, United Kingdom
Feb 5, 2018 -
Feb 10, 2018
 

Training Event
Incident Response & Forensics
SANS 2018
Orlando, FL
Apr 3, 2018 -
Apr 8, 2018
 

Training Event
Incident Response & Forensics
May 11, 2018 -
May 16, 2018
 

Summit
Incident Response & Forensics
Jun 9, 2018 -
Jun 14, 2018
 

SelfStudy
Incident Response & Forensics
Online
Staff
Anytime  

OnDemand
Incident Response & Forensics
Online
Anytime  

Private Training
All Private Training Course of Your Choice Your Choice  

*Course contents may vary depending upon location, see specific event description for details.