Difference between revisions of "Mac forensics"

From Simson Garfinkel
Jump to navigationJump to search
 
(6 intermediate revisions by the same user not shown)
Line 12: Line 12:
* [https://support.apple.com/en-us/HT201222 Apple Security Updates]
* [https://support.apple.com/en-us/HT201222 Apple Security Updates]
* [https://support.apple.com/specs Apple Tech Specs]
* [https://support.apple.com/specs Apple Tech Specs]
==Other curricula==
* [https://drive.google.com/drive/folders/145wtnnHCX40myGEYAmxJbO1frfRLXOj5 Google Drive from 2019 Mac Forensics Course]
* [https://www.iacis.com/training/macintosh-forensic-survival-course-mfsc/ Mac I: Best Practices in MAC Forensics]
* [https://www.iacis.com/training/mac-ii-advanced-practices-in-mac-forensics/ Mac II: Advanced Practices in MAC Forensics]
* [https://www.ma.rhul.ac.uk/static/techrep/2015/RHUL-MA-2015-8.pdf Mac OS X Forensics Joaquin Moreno Garijo, Technical Report, RHUL–MA–2015–8 4 March 2015]


==Drive Image Tools==
==Drive Image Tools==
Line 19: Line 25:
==Forensics Programs==
==Forensics Programs==
* [https://www.blackbagtech.com/blacklight.html BlackLight®], by BlackBag Technologies
* [https://www.blackbagtech.com/blacklight.html BlackLight®], by BlackBag Technologies
* https://davidkoepi.wordpress.com/2011/06/12/macosxaddressbookforensics/
* [https://github.com/mac4n6/APOLLO APOLLO]


==Terminal Hacks==
==Terminal Hacks==
Line 34: Line 42:
* Cracking FileVault2 with JohnTheRipper
* Cracking FileVault2 with JohnTheRipper
* The Diskutil command
* The Diskutil command
==Live system monitoring==
===File system monitoring===
Watchdog is the common cross-platform interface for writing python programs that monitor the file system.  [https://media.readthedocs.org/pdf/watchdog/latest/watchdog.pdf (DOCS)]
* https://pypi.org/project/watchdog/
* Example of how to use it: https://github.com/mkaz/fswatch/blob/master/fswatch.py
* https://blog.philippklaus.de/2011/08/watching-directories-for-changes-using-python_-_an-overview
* https://www.michaelcho.me/article/using-pythons-watchdog-to-monitor-changes-to-a-directory
===Live system monitoring===
* https://nicolargo.github.io/glances/

Latest revision as of 15:52, 18 June 2020

Notes on Mac Forensics.

On the Web

Apple's Resources

Other curricula

Drive Image Tools

Forensics Programs

Terminal Hacks

Is FV2 running?

   fdsetup status

People

Ryan Kubasiak, previously ran http://www.macosxforensics.com/, now on the digital crimes team at Apple

Archives

  • MacOS X Forensics, Philip Craiger and Paul Burke, IFIP, DigitalForensics 2006, Advances in Digital Forensics II


Course Ideas

  • Cracking FileVault2 with JohnTheRipper
  • The Diskutil command


Live system monitoring

File system monitoring

Watchdog is the common cross-platform interface for writing python programs that monitor the file system. (DOCS)

Live system monitoring