FOR518: Mac and iOS Forensic Analysis and Incident Response

Overview

This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully and easily collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.

Exercises

• Course Lab Setup
• Inspector Case Setup and Image Mounting
• Exploring iOS Acquisitions
• Disks and Partitions

Topics

• Apple Essentials
• Mac and iOS Systems
• Mac Analysis in a Windows World
• Apple Fundamentals
• Mac Essentials and Acquisition
• Mac File System Domains
• Mac Directory Structures
• Containers and Sandboxes
• Acquisition Pitfalls and Considerations
• Hard Drive, Network, and Memory Acquisition Tools
• Image Mounting Using Open-Source Utilities
• iOS Essentials and Acquisition
• Differences between iOS and macOS
• Security and Encryption
• Jailbreaks
• Acquisition Types and Differences
• Local and iCloud Backups
• Tools for Acquisition and Analysis
• Passcode Bypass and Cracking
• Disks and Partitions
• Disk Layout
• Partition Schemes
• GPT
• FileVault
• Disk Images
• CoreStorage
• APFS Containers
• Bootcamp
• Fusion Drives

Overview

Starting out, students will review Mac and iOS triage data. This data is often required to start an analysis of a device. Students will then build on that information to look at a variety of great artifacts that implement the file system and that are different from other operating systems students have seen in the past. In an additional bonus section students will learn the building blocks of Mac and iOS forensics with a thorough deep-dive understanding of the Apple File system (APFS). Utilizing a hex editor, students will learn the basic structures of the primary file system implemented on MacOS and iOS systems.

Exercises

• Mac and iOS Triage
• File System Fun!

• Parsing APFS

Topics

• Mac and iOS Triage
• OS Version
• Device Identifying Data
• System Installation
• Network Settings
• Time Zone and Location Services
• User Accounts

• Managed Devices

• Extended Attributes
• Contents
• Analysis
• Tool Support
• Forensically Useful Attributes
• File System Events Store Database
• Usage
• Parsing with Tools
• Practical Analysis
• Spotlight
• Analysis Methods and Tools
• Practical Queries
• Portable Artifacts
• Artifacs Left Behind by Macs
• Differences from Various File Systems

• File Systems

  • Overview of HFS+ & APFS
  • Data Structures
  • Manual Parsing
  • APFS Clones
  • APFS Snapshots

  • APFS Benefits and Caveats

Overview

Mac and iOS devices contain many system settings that can show how a device was used (or abused). A user of the device may change a specific configuration that can provide useful forensic insight. Often these configuration actions can be also found in the logs and provide historical context to create a detailed story of how the device was used.

This section focuses on system and data configurations alongside log analysis. These devices have many different types of logs each with their own method for analysis and content. The log entries can be correlated with user and system data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently.

Exercises

• Parsing System Logs
• Log Analysis

• User Data and System Configuration, Part I and Part II

Topics

• Parsing System Logs

  • Log Basics
  • Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
  • Log Configuration

  • Analysis Methods and Parsing Tools

• Log Analysis

  • Tools & Methods
  • Volume Analysis
  • System State
  • Software Installations
  • Application Bundles & Extensions

  • AirDrop

• User Data and System Configuration
• Time Machine
• Network
• Keyboard
• Notifications
• User Interface
• Saved Application State
• Date & Time
• Bluetooth
• Printing
• Screen Sharing
• SSH & Terminal History
• User Activity
• Autoruns
• Firewall
• Keychain
• Screen Time

Overview

In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.

This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.

Exercises

• iOS Snapshots, App Permissions, and MRUs
• Safari and Mail
• Applications  Part I

• Applications  Part II

Topics

• Application Fundamentals
• Locations
• iOS Snapshots
• App Permissions & Privacy Settings
• Location Services
• Most Recently Used (MRUs)
• Configured Accounts

• Application Testing & Analysis

• SQL Lite

  • Building Queries

  • Database Analysis

• Safari Browser
• History
• Session Information
• Cache
• Syncing
• Private Mode
• Apple Mail
• Locations and Data Access
• Mail Accounts and Configuration
• Attachments
• Metadata
• Communication
• Messages
• FaceTime
• SMS and iMessage
• Call History
• Voicemail
• Many Other Applications
• Calendar
• Reminders
• Contacts
• Notes
• Wallet & Apple Pay
• Photos
• Maps
• Apple Watch

Overview

Apple systems implement some technologies that are available only to those with Mac and iOS devices. In this section, students will learn about a variety of topics that can be used in a variety of investigations. Topics such as pattern of life will detail very specific user and device activities which can determine which app was being used at precise time, how many steps did they walk, was the device unlocked, or where the device was.

Other technologies include Document Versions which provide historical snapshots of documents and iCloud data syncing. Other advanced topics include cracking into data hidden in encrypted containers, live response, indicators of compromise, security technologies, malware analysis, and Mac memory analysis.

Exercises

• Pattern of Life
• Document Versions
• Malware and Live Response
• Memory Analysis, Password Cracking, and Encrypted Containers

Topics

• Pattern of Life
• Application Usage
• Media Usage
• Device Status
• Health

• Location Data

• Document Versions
• Versions Metadata
• Versions Database
• Generations
• Chunk Storage
• iCloud
• Synced Accounts
• Mobile Documents
• Synced Preferences
• Apple Malware
• Intrusion Vectors
• File Quarantine
• XProtect
• Gatekeeper

• Notarization

• Live Response
• Live Triage Techniques
• Volatile Data Collection
• Memory Acquisitions and Analysis
• Acquisition Tools
• Analysis Tools
• Password Cracking and Encrypted Containers
• Password Shadow Files
• Cracking Passwords
• Dictionary Files Keychains
• FileVault
• Encrypted Volumes and Disk Images

Overview

In this final course section, students will put their new Mac forensic skills to the test by running through a real-life scenario with team members.

Topics:

• In-Depth File System Examination
• File System Timeline Analysis
• Advanced Computer Forensics Methodology
• Mac Memory Analysis
• File System Data Analysis
• Metadata Analysis
• Recovering Key Mac Files
• Volume and Disk Image Analysis
• Analysis of Apple-specific Technologies
• Advanced Log Analysis and Correlation

• iDevice Analysis and iOS Artifacts