Difference between revisions of "Mac forensics"

From Simson Garfinkel
Jump to navigationJump to search
m
Line 40: Line 40:
* Cracking FileVault2 with JohnTheRipper
* Cracking FileVault2 with JohnTheRipper
* The Diskutil command
* The Diskutil command
==Live system monitoring==
===File system monitoring===
Watchdog is the common cross-platform interface for writing python programs that monitor the file system.  [https://media.readthedocs.org/pdf/watchdog/latest/watchdog.pdf (DOCS)]
* https://pypi.org/project/watchdog/
* Example of how to use it: https://github.com/mkaz/fswatch/blob/master/fswatch.py
* https://blog.philippklaus.de/2011/08/watching-directories-for-changes-using-python_-_an-overview
* https://www.michaelcho.me/article/using-pythons-watchdog-to-monitor-changes-to-a-directory

Revision as of 05:27, 26 November 2018

Notes on Mac Forensics.

On the Web

Apple's Resources

Other curricula

Drive Image Tools

Forensics Programs

Terminal Hacks

Is FV2 running?

   fdsetup status

People

Ryan Kubasiak, previously ran http://www.macosxforensics.com/, now on the digital crimes team at Apple

Archives

  • MacOS X Forensics, Philip Craiger and Paul Burke, IFIP, DigitalForensics 2006, Advances in Digital Forensics II


Course Ideas

  • Cracking FileVault2 with JohnTheRipper
  • The Diskutil command


Live system monitoring

File system monitoring

Watchdog is the common cross-platform interface for writing python programs that monitor the file system. (DOCS)