FOR518: Mac and iOS Forensic Analysis and Incident Response

Overview

This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully and easily collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.

Exercises

• Lab Setup
• BlackLight and Image Mounting
• Exploring iOS Acquisitions
• Disks and Partitions

Topics

• Apple Essentials
• Mac and iOS Systems
• Mac Analysis in a Windows World
• Apple Fundamentals
• Mac Essentials and Acquisition
• Mac File System Domains
• Mac Directory Structures
• Containers and Sandboxes
• Acquisition Pitfalls and Considerations
• Hard Drive, Network, and Memory Acquisition Tools
• Image Mounting Using Open-Source Utilities
• iOS Essentials and Acquisition
• Differences between iOS and macOS
• Security and Encryption
• Jailbreaks
• Acquisition Types and Differences
• Local and iCloud Backups
• Tools for Acquisition and Analysis
• Passcode Bypass and Cracking
• Disks and Partitions
• Disk Layout
• Partition Schemes
• GPT
• FileVault
• Disk Images
• CoreStorage
• APFS Containers
• Bootcamp
• Fusion Drives

Overview

The building blocks of Mac and iOS forensics start with a thorough understanding of the HFS+. Utilizing a hex editor, students will learn the basic principles of the primary file system implemented on MacOS systems. Students will then use that information to look at a variety of great artifacts that use the file system and that are different from other operating systems students have seen in the past. Rounding out the day, students will review Mac and iOS triage data.

Exercises

• HFS+
• File System Fun!
• Mac and iOS Triage

Topics

• File Systems
• Overview of HFS+ & APFS
• Data Structures
• Manual Parsing
• APFS Clones
• APFS Snapshots
• APFS Benefits and Caveats
• Tool Output and Caveats
• Extended Attributes
• Contents
• Analysis
• Tool Support
• Interesting Attributes
• File System Events Store Database
• Usage
• Parsing with Tools
• Practical Analysis
• Spotlight
• Analysis Methods and Tools
• Practical Queries
• Portable Artifacts
• Artifacts Left Behind by Macs
• Differences from Various File Systems
• Mac and iOS Triage
• OS Version
• Device Identifying Data
• System Installation
• Network Settings
• Time Zone and Location Services
• User Accounts
• Managed Devices
• Mail and Internet Account Settings
• Most Recently Used (MRUs)
• Recent iOS Apps
• Recent Folders
• Recent Applications
• Recent Documents
• Recent Servers
• Recent Files
• Parsing Methods and Tools
• Alias and Bookmark BLOBs
• NSKeyed Archiver Plist File Manual Parsing

Overview

This section contains a wide array of information that can be used to profile and understand how individuals use their computers. The logical Mac file system is made up of four domains: User, Local, System, and Network. The User Domain contains most of the user-related items of forensic interest. This domain consists of user preferences and configurations.

The Local and System Domains contain system-specific information such as application installation, system settings and preferences, and system logs. This section details basic system information, GUI preferences, and system application data. A basic analysis of system logs can provide a good understanding of how a system was used or abused. The Network domain is more ethereal and we can find this in many places throughout the course as well as in the logs.

Timeline analysis tells the story of how the system was used. Each entry in a log file has a specific meaning and may be able to tell how the user interacted with the computer. The log entries can be correlated with other data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently. Analysis tools and techniques will be used to correlate the data and help the student put the story back together in a coherent and meaningful way.

Exercises

• User Data and System Configuration
• Log Parsing and Analysis
• Timeline Analysis and Data Correlation

Topics

• User Data and System Configuration
• Bash History
• Keychains
• Printing
• Firewall Settings
• Sharing Settings
• Bluetooth
• Autoruns
• Application Bundles
• Software Updates
• GUI Settings
• Log Parsing and Analysis
• Log Basics
• Log Formats
• Log Recovery
• Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
• Log Configuration
• Analysis Methods and Parsing Tools
• Timeline Analysis and Data Correlation
• Temporal Context and Timestamps
• Volume Analysis
• Temporal Changes
• System Information and State
• Network Analysis
• User Access
• Privilege Escalation
• Account Creation/Deletion
• Software Installation
• Backup Activity
• Locational Data

Overview

In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.

This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.

Exercises

• Safari and Mail
• Applications - Part I
• Applications - Part II

Topics

• Application Permissions
• Privacy Settings
• Location Services
• Native Application Fundamentals
• Locations
• Snapshots
• Safari Browser
• History
• Cache
• Syncing
• Private Mode
• Data Retention
• Apple Mail
• Locations and Data Access
• Mail Accounts and Configuration
• Attachments
• Metadata
• Communication
• iChat/Messages
• FaceTime
• SMS
• iMessage
• Call History
• Voicemail
• Calendar and Reminders
• Files
• Database Analysis
• Contacts
• Files
• Database Analysis
• Notes
• Files
• Database Analysis
• Version Differences
• Media Analysis
• Apple Pay, Wallet, Passes
• Files
• Database Analysis
• Photos
• Files
• Database Analysis
• iCloud Syncing
• Maps
• Files
• Database Analysis
• Caveats
• Location Data
• Routine, WiFi, Cellular Locations
• Files
• Database Analysis
• Tools and Parsing
• Apple Watch
• Files
• Capabilities
• Synced Data
• Third-Party Apps
• Locations
• Analysis Caveats
• Data Structure
• Analysis Tools

Overview

Mac systems implement some technologies that are available only to those with Mac and iOS devices. These include data backup with Time Machine, Document Versions, and iCloud, as well as disk encryption with FileVault. Other advanced topics include data hidden in encrypted containers, live response, Mac intrusion and malware analysis, and Mac memory analysis.

Exercises

• Time Machine and Document Versions
• Malware and Live Response
• Memory Analysis, Password Cracking, and Encrypted Containers

Topics

• Time Machine
• Backup Settings
• Backup Volumes
• Snapshot Analysis
• Local Snapshots
• Encrypted Backups
• Mounting and Analysis
• Document Versions
• Versions Metadata
• Versions Database
• Generations
• Chunk Storage
• iCloud
• Synced Accounts
• Mobile Documents
• Synced Preferences
• Malware and Intrusion Analysis
• Intrusion Analysis
• Java Cache and IDX Files
• File Quarantine
• XProtect
• Gatekeeper
• Live Response
• Live Triage Techniques
• Volatile Data Collection
• Memory Acquisitions and Analysis
• Acquisition Tools
• Analysis Tools
• Password Cracking and Encrypted Containers
• Password Shadow Files
• Cracking Software
• Keychains
• FileVault
• Encrypted Volumes and Disk Images

Overview

In this final course section, students will put their new Mac forensic skills to the test by running through a real-life scenario with team members.

Topics:

• In-Depth File System Examination
• File System Timeline Analysis
• Advanced Computer Forensics Methodology
• Mac Memory Analysis
• File System Data Analysis
• Metadata Analysis
• Recovering Key Mac Files
• Volume and Disk Image Analysis
• Analysis of Mac Technologies including Time Machine, Spotlight, and FileVault
• Advanced Log Analysis and Correlation
• iDevice Analysis and iOS Artifacts