VII

FRN 4302, Digital Forensics Applications 1

Course Learning Outcomes for Unit VII Upon completion of this unit, students should be able to:

5. Utilize forensic toolkits for evidence forensics enumeration. 5.1 Explore the Macintosh operating system. 5.2 Use forensics tools to complete tasks on a Macintosh system.

Required Unit Resources Chapter 12: Mac Forensics Unit Lesson

Introduction In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become an important forensic discipline. You have developed knowledge of how a cellular network operates and the evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should also now be aware of some of the gray areas that exist in terms of legal considerations when conducting mobile device investigations. Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of how to examine Apple mobile devices.

The Importance of Mac Forensics Apple is a unique company and one that does not take to being told how to act in terms of security (Benner & Mozur, 2016). The devices they produce are popular because of their level of performance as well as the security aspects they offer. It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If we assume that this equates to the proportion of actual criminal activity that is being conducted, the importance of the Mac in digital forensics cannot be underestimated.

The Apple File System: Hierarchical File System (HFS and HFS+) This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the significance of this system in digital forensics. When any device is seized, the data and information within it may or may not have been deleted. The forensic investigator needs to recover the data regardless of the state it is in. Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space, and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which adopts functionality that assists in searching for data whether it has been deleted or not.

UNIT VII STUDY GUIDE Mac Forensics

FRN 4302, Digital Forensics Applications 2

UNIT x STUDY GUIDE Title

One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and how to search this metadata can assist in the recovery of deleted data and, therefore, advance an investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).

Virtual Memory Anti-Forensic Tools Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time- frame requirements. The exception is when the user cooperates and provides their log-in details. The ability to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any other additional volumes created by the user. Each custom volume can be protected by its own specific username and password (Leopard et al., 2015). Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic investigators today (D’Orazio et al., 2014). This has led to a different approach being adopted for forensic evidence, involving acquiring main memory and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through memory analysis (Amari, 2009).

The Importance of PList Examinations Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar information in Mac OS X as they would find on the more common Windows machines. Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless networks, internet history, and third party software, all information that can make forensic evidence a success or a failure (Farmer, n.d.). Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos, 2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods, devices running iOS have always proved challenging to extract data from, and they seem designed to keep the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it (Farley, 2019).

Acquiring iOS Devices and Acquisition Tools Phone Identification During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the printed model number. There are other methods, also. Even if the device is locked, information can still be obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS version, hardware model and telephony capability to be shown.

FRN 4302, Digital Forensics Applications 3

UNIT x STUDY GUIDE Title

The Device’s Operating Mode It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let an investigator know which mode should be operated to extract data. IOS devices can be operated in three modes:

• Normal mode, • Recovery mode, and • DFU mode.

Breaking iOS Passcodes There are various methods and tools available to break an iOS device’s passcode, and these are generally dependent on the iOS version on the device. These tools are a mixture of commercial and open-source technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source). Directly Acquiring an iOS Device A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac workstation and browsing the information needed. Logical Acquisition Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process that already exists on the Apple operating system. Evidence contained within vital files can be extracted and analyzed efficiently via logical acquisition (Proffitt, 2012).

Summary IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to develop innovating operating systems that prove challenging to forensic investigations. Digital forensic professionals of all disciplines should be prepared to overcome whatever these challenging new innovations are.

References

Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS. https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing- data-volatile-memory-33049

Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York

Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.

https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely

conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819

Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.

http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/ Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.

https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry

FRN 4302, Digital Forensics Applications 4

UNIT x STUDY GUIDE Title

Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium. https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd

Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-

size/ Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating

system. In Digital Forensics and Cyber Crime (pp. 175–180). http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm

Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.

https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.

https://www.dataforensics.org/mac-os-x-forensics-analysis/ Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/ Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-

room/whitepapers/forensics/forensic-analysis-ios-devices-34092 Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].

https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd Learning Activities (Nongraded) Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit them. If you have questions, contact your instructor for further guidance and information. To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter 12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you an opportunity to test yourself and then give feedback on your answers.

FRN 4302, Digital Forensics Applications 1

Course Learning Outcomes for Unit VII Upon completion of this unit, students should be able to:

5. Utilize forensic toolkits for evidence forensics enumeration. 5.1 Explore the Macintosh operating system. 5.2 Use forensics tools to complete tasks on a Macintosh system.

Required Unit Resources Chapter 12: Mac Forensics Unit Lesson

Introduction In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become an important forensic discipline. You have developed knowledge of how a cellular network operates and the evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should also now be aware of some of the gray areas that exist in terms of legal considerations when conducting mobile device investigations. Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of how to examine Apple mobile devices.

The Importance of Mac Forensics Apple is a unique company and one that does not take to being told how to act in terms of security (Benner & Mozur, 2016). The devices they produce are popular because of their level of performance as well as the security aspects they offer. It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If we assume that this equates to the proportion of actual criminal activity that is being conducted, the importance of the Mac in digital forensics cannot be underestimated.

The Apple File System: Hierarchical File System (HFS and HFS+) This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the significance of this system in digital forensics. When any device is seized, the data and information within it may or may not have been deleted. The forensic investigator needs to recover the data regardless of the state it is in. Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space, and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which adopts functionality that assists in searching for data whether it has been deleted or not.

UNIT VII STUDY GUIDE Mac Forensics

FRN 4302, Digital Forensics Applications 2

UNIT x STUDY GUIDE Title

One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and how to search this metadata can assist in the recovery of deleted data and, therefore, advance an investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).

Virtual Memory Anti-Forensic Tools Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time- frame requirements. The exception is when the user cooperates and provides their log-in details. The ability to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any other additional volumes created by the user. Each custom volume can be protected by its own specific username and password (Leopard et al., 2015). Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic investigators today (D’Orazio et al., 2014). This has led to a different approach being adopted for forensic evidence, involving acquiring main memory and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through memory analysis (Amari, 2009).

The Importance of PList Examinations Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar information in Mac OS X as they would find on the more common Windows machines. Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless networks, internet history, and third party software, all information that can make forensic evidence a success or a failure (Farmer, n.d.). Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos, 2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods, devices running iOS have always proved challenging to extract data from, and they seem designed to keep the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it (Farley, 2019).

Acquiring iOS Devices and Acquisition Tools Phone Identification During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the printed model number. There are other methods, also. Even if the device is locked, information can still be obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS version, hardware model and telephony capability to be shown.

FRN 4302, Digital Forensics Applications 3

UNIT x STUDY GUIDE Title

The Device’s Operating Mode It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let an investigator know which mode should be operated to extract data. IOS devices can be operated in three modes:

• Normal mode, • Recovery mode, and • DFU mode.

Breaking iOS Passcodes There are various methods and tools available to break an iOS device’s passcode, and these are generally dependent on the iOS version on the device. These tools are a mixture of commercial and open-source technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source). Directly Acquiring an iOS Device A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac workstation and browsing the information needed. Logical Acquisition Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process that already exists on the Apple operating system. Evidence contained within vital files can be extracted and analyzed efficiently via logical acquisition (Proffitt, 2012).

Summary IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to develop innovating operating systems that prove challenging to forensic investigations. Digital forensic professionals of all disciplines should be prepared to overcome whatever these challenging new innovations are.

References

Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS. https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing- data-volatile-memory-33049

Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York

Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.

https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely

conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819

Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.

http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/ Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.

https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry

FRN 4302, Digital Forensics Applications 4

UNIT x STUDY GUIDE Title

Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium. https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd

Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-

size/ Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating

system. In Digital Forensics and Cyber Crime (pp. 175–180). http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm

Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.

https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.

https://www.dataforensics.org/mac-os-x-forensics-analysis/ Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/ Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-

room/whitepapers/forensics/forensic-analysis-ios-devices-34092 Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].

https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd Learning Activities (Nongraded) Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit them. If you have questions, contact your instructor for further guidance and information. To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter 12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you an opportunity to test yourself and then give feedback on your answers.