Macintosh ForensicsA Guide for the Forensically Sound Examination of a Macintosh ComputerRyan R. Kubasiak, Investigator - New York State Policerev. May 29, 20071 of 72
About The Author5Contact Information6Email6Telephone6Fax6Mail6About This Document7Tools Needed and Requirements of the Document8Digital Examination Overview9File System12Operating Systems12Data Files12MAN Pages13Technologies14Bonjour14FileVault14Spotlight15UNIX and the FreeBSD System15Microsoft Windows on a Mac?15Disk Arbitration16Activate/Deactivate Disk Arbitration16Target Disk Mode18Target Disk Mode Procedure19The Macintosh Boot Process20Open Firmware and Extensible Firmware Interface20rev. May 29, 20072 of 72
Startup Manager20BootX, boot.efi, and System Initialization21Boot EFI Utilities23rEFIt23Booting a Macintosh from the LiveCD24Imaging a Target Macintosh25Target Disk Mode25LiveCD26Drive Removal26Disk Structure27Apple Partition Map27GUID Partition Table29Journaling31FileVault and MacOS X Security32FileVault Preference Pane32sparseimage and User Home Directory35Acquire the Encrypted User Home Directory36DiskUtility and DMG Files41DiskUtility Features41DMG vs. sparseimage41Encrypted vs. Unencrypted42DD and Raw Images42Spotlight43User Home Directory Structure44User Library Folder - In Depth46rev. May 29, 20073 of 72
Applications48Address Book48iCal48Mail48.Mac and Related Evidence49.Mac49Safari, and Other Web Browsers50Safari50iChat, and Instant Messaging Applications51iChat51Mac OS X Log Files52Mac OS X “plist” Files53Sleep and Safe Sleep56Detailed Macintosh Techniques57Apple Boot Key Combos57Create a Brute Force Dictionary File58Useful Artifacts and Commands59References61Websites62Recommended Utilities and Applications63MacOS X 10.4 Command Line Utilities and Daemons64rev. May 29, 20074 of 72
About The AuthorI began my foray into the world of computers in 7th grade. Our school laboratory was using Com-modore 64 computers and the BASIC programming language. Soon, my parents purchased an Ap-ple IIc for our home and I continued writing in BASIC, and now “Apple Logo”as well. My intrigue continued thru high school developing my skills in BASIC and the Pascal programming languages. Ultimately, I achieved Advanced Placement in Computer Science my senior year, yielding college credits.I went on to the State University of New York at Buffalo and earned a Bachelor of Science in Com-puter Science and a Concentration in Mathematics. All of my schooling was done on the Macin-tosh LC, VAX/VMS and Sun Solaris based systems. We utilized Modula-2 and C as programming languages. C++ just wasn’t prevalent enough during my college years. One of my favorite achieve-ments of college was writing from scratch, an Assembly language code compiler. I also wrote a multi-tasking operating system for a fictitious Robot, and a dating service front and back end for a fictitious customer.