Difference between revisions of "Mac forensics"

From Simson Garfinkel
Jump to navigationJump to search
 
(4 intermediate revisions by the same user not shown)
Line 14: Line 14:


==Other curricula==
==Other curricula==
* [https://drive.google.com/drive/folders/145wtnnHCX40myGEYAmxJbO1frfRLXOj5 Google Drive from 2019 Mac Forensics Course]
* [https://www.iacis.com/training/macintosh-forensic-survival-course-mfsc/ Mac I: Best Practices in MAC Forensics]
* [https://www.iacis.com/training/macintosh-forensic-survival-course-mfsc/ Mac I: Best Practices in MAC Forensics]
* [https://www.iacis.com/training/mac-ii-advanced-practices-in-mac-forensics/ Mac II: Advanced Practices in MAC Forensics]
* [https://www.iacis.com/training/mac-ii-advanced-practices-in-mac-forensics/ Mac II: Advanced Practices in MAC Forensics]
* [https://www.ma.rhul.ac.uk/static/techrep/2015/RHUL-MA-2015-8.pdf Mac OS X Forensics Joaquin Moreno Garijo, Technical Report, RHUL–MA–2015–8 4 March 2015]


==Drive Image Tools==
==Drive Image Tools==
Line 24: Line 26:
* [https://www.blackbagtech.com/blacklight.html BlackLight®], by BlackBag Technologies
* [https://www.blackbagtech.com/blacklight.html BlackLight®], by BlackBag Technologies
* https://davidkoepi.wordpress.com/2011/06/12/macosxaddressbookforensics/
* https://davidkoepi.wordpress.com/2011/06/12/macosxaddressbookforensics/
* [https://github.com/mac4n6/APOLLO APOLLO]


==Terminal Hacks==
==Terminal Hacks==
Line 39: Line 42:
* Cracking FileVault2 with JohnTheRipper
* Cracking FileVault2 with JohnTheRipper
* The Diskutil command
* The Diskutil command
==Live system monitoring==
===File system monitoring===
Watchdog is the common cross-platform interface for writing python programs that monitor the file system.  [https://media.readthedocs.org/pdf/watchdog/latest/watchdog.pdf (DOCS)]
* https://pypi.org/project/watchdog/
* Example of how to use it: https://github.com/mkaz/fswatch/blob/master/fswatch.py
* https://blog.philippklaus.de/2011/08/watching-directories-for-changes-using-python_-_an-overview
* https://www.michaelcho.me/article/using-pythons-watchdog-to-monitor-changes-to-a-directory
===Live system monitoring===
* https://nicolargo.github.io/glances/

Latest revision as of 15:52, 18 June 2020

Notes on Mac Forensics.

On the Web

Apple's Resources

Other curricula

Drive Image Tools

Forensics Programs

Terminal Hacks

Is FV2 running?

   fdsetup status

People

Ryan Kubasiak, previously ran http://www.macosxforensics.com/, now on the digital crimes team at Apple

Archives

  • MacOS X Forensics, Philip Craiger and Paul Burke, IFIP, DigitalForensics 2006, Advances in Digital Forensics II


Course Ideas

  • Cracking FileVault2 with JohnTheRipper
  • The Diskutil command


Live system monitoring

File system monitoring

Watchdog is the common cross-platform interface for writing python programs that monitor the file system. (DOCS)

Live system monitoring