Assignment Prompt & Instructions
see attached
**files (2)**
– ## VII.docx
– ## UnitVII.pdf
**## VII.docx**
For this assignment, you are asked to prepare a reflection paper. Based on the course concepts we have covered thus far, reflect on three of the major concepts discussed in the readings, and write about those concepts. You should pick one concept related to mobile forensics, one related to forensics tools, and one related to network forensics. How do those concepts relate to the subject of digital forensics as a whole? How have those concepts affected digital forensics in the past? How will the concepts affect digital forensics in the future? Wil these concepts affect you in your career? Why, or why not?
The purpose of this assignment is to provide you with an opportunity to reflect on the material that you have read and to expand on your reading.
The writing that you submit must meet the following requirements:
· at least two pages in length,
· include your thoughts about the major concepts that you select,
· explain how the concepts impact digital forensics, and
· explain how the concepts apply to your career.
References are not required for this assignment, but if outside sources are used, please adhere to APA Style when creating citations and references for this assignment.
**## UnitVII.pdf**
FRN 4302, Digital Forensics Applications 1
Course Learning Outcomes for Unit VII
Upon completion of this unit, students should be able to:
5. Utilize forensic toolkits for evidence forensics enumeration.
5.1 Explore the Macintosh operating system.
5.2 Use forensics tools to complete tasks on a Macintosh system.
Required Unit Resources
Chapter 12: Mac Forensics
Unit Lesson
Introduction
In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become
an important forensic discipline. You have developed knowledge of how a cellular network operates and the
evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should
also now be aware of some of the gray areas that exist in terms of legal considerations when conducting
mobile device investigations.
Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an
introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into
virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and
hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of
how to examine Apple mobile devices.
The Importance of Mac Forensics
Apple is a unique company and one that does not take to being told how to act in terms of security (Benner &
Mozur, 2016). The devices they produce are popular because of their level of performance as well as the
security aspects they offer.
It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If
we assume that this equates to the proportion of actual criminal activity that is being conducted, the
importance of the Mac in digital forensics cannot be underestimated.
The Apple File System: Hierarchical File System (HFS and HFS+)
This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the
significance of this system in digital forensics. When any device is seized, the data and information within it
may or may not have been deleted. The forensic investigator needs to recover the data regardless of the
state it is in.
Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space,
and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a
haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which
adopts functionality that assists in searching for data whether it has been deleted or not.
UNIT VII STUDY GUIDE
Mac Forensics
FRN 4302, Digital Forensics Applications 2
UNIT x STUDY GUIDE
Title
One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata
that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and
how to search this metadata can assist in the recovery of deleted data and, therefore, advance an
investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can
hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression
means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).
Virtual Memory Anti-Forensic Tools
Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines
virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the
operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time-
frame requirements. The exception is when the user cooperates and provides their log-in details. The ability
to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any
other additional volumes created by the user. Each custom volume can be protected by its own specific
username and password (Leopard et al., 2015).
Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic
evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata
overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic
investigators today (D’Orazio et al., 2014).
This has led to a different approach being adopted for forensic evidence, involving acquiring main memory
and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network
packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile
memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through
memory analysis (Amari, 2009).
The Importance of PList Examinations
Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it
is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar
information in Mac OS X as they would find on the more common Windows machines.
Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first
explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless
networks, internet history, and third party software, all information that can make forensic evidence a success
or a failure (Farmer, n.d.).
Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for
the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos,
2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods,
devices running iOS have always proved challenging to extract data from, and they seem designed to keep
the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a
passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it
(Farley, 2019).
Acquiring iOS Devices and Acquisition Tools
Phone Identification
During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model
is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the
printed model number. There are other methods, also. Even if the device is locked, information can still be
obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS
version, hardware model and telephony capability to be shown.
FRN 4302, Digital Forensics Applications 3
UNIT x STUDY GUIDE
Title
The Device’s Operating Mode
It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let
an investigator know which mode should be operated to extract data. IOS devices can be operated in three
modes:
• Normal mode,
• Recovery mode, and
• DFU mode.
Breaking iOS Passcodes
There are various methods and tools available to break an iOS device’s passcode, and these are generally
dependent on the iOS version on the device. These tools are a mixture of commercial and open-source
technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source).
Directly Acquiring an iOS Device
A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down
certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac
workstation and browsing the information needed.
Logical Acquisition
Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process
that already exists on the Apple operating system. Evidence contained within vital files can be extracted and
analyzed efficiently via logical acquisition (Proffitt, 2012).
Summary
IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it
very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s
loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to
develop innovating operating systems that prove challenging to forensic investigations. Digital forensic
professionals of all disciplines should be prepared to overcome whatever these challenging new innovations
are.
References
Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS.
https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing-
data-volatile-memory-33049
Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York
Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html
Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.
https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf
D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely
conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on
System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819
Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.
http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/
Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.
https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry
FRN 4302, Digital Forensics Applications 4
UNIT x STUDY GUIDE
Title
Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium.
https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd
Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-
size/
Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating
system. In Digital Forensics and Cyber Crime (pp. 175–180).
http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm
Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.
https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics
Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.
https://www.dataforensics.org/mac-os-x-forensics-analysis/
Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/
Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-
room/whitepapers/forensics/forensic-analysis-ios-devices-34092
Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].
https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd
Learning Activities (Nongraded)
Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit
them. If you have questions, contact your instructor for further guidance and information.
To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter
12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you
an opportunity to test yourself and then give feedback on your answers.
– Course Learning Outcomes for Unit VII
– Required Unit Resources
– Unit Lesson
– Introduction
– The Importance of Mac Forensics
– The Apple File System: Hierarchical File System (HFS and HFS+)
– Virtual Memory Anti-Forensic Tools
– The Importance of PList Examinations
– Acquiring iOS Devices and Acquisition Tools
– Phone Identification
– The Device’s Operating Mode
– Breaking iOS Passcodes
– Directly Acquiring an iOS Device
– Logical Acquisition
– Summary
– References
– Learning Activities (Nongraded)
**## UnitVII.pdf**
FRN 4302, Digital Forensics Applications 1
Course Learning Outcomes for Unit VII
Upon completion of this unit, students should be able to:
5. Utilize forensic toolkits for evidence forensics enumeration.
5.1 Explore the Macintosh operating system.
5.2 Use forensics tools to complete tasks on a Macintosh system.
Required Unit Resources
Chapter 12: Mac Forensics
Unit Lesson
Introduction
In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become
an important forensic discipline. You have developed knowledge of how a cellular network operates and the
evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should
also now be aware of some of the gray areas that exist in terms of legal considerations when conducting
mobile device investigations.
Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an
introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into
virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and
hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of
how to examine Apple mobile devices.
The Importance of Mac Forensics
Apple is a unique company and one that does not take to being told how to act in terms of security (Benner &
Mozur, 2016). The devices they produce are popular because of their level of performance as well as the
security aspects they offer.
It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If
we assume that this equates to the proportion of actual criminal activity that is being conducted, the
importance of the Mac in digital forensics cannot be underestimated.
The Apple File System: Hierarchical File System (HFS and HFS+)
This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the
significance of this system in digital forensics. When any device is seized, the data and information within it
may or may not have been deleted. The forensic investigator needs to recover the data regardless of the
state it is in.
Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space,
and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a
haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which
adopts functionality that assists in searching for data whether it has been deleted or not.
UNIT VII STUDY GUIDE
Mac Forensics
FRN 4302, Digital Forensics Applications 2
UNIT x STUDY GUIDE
Title
One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata
that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and
how to search this metadata can assist in the recovery of deleted data and, therefore, advance an
investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can
hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression
means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).
Virtual Memory Anti-Forensic Tools
Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines
virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the
operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time-
frame requirements. The exception is when the user cooperates and provides their log-in details. The ability
to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any
other additional volumes created by the user. Each custom volume can be protected by its own specific
username and password (Leopard et al., 2015).
Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic
evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata
overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic
investigators today (D’Orazio et al., 2014).
This has led to a different approach being adopted for forensic evidence, involving acquiring main memory
and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network
packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile
memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through
memory analysis (Amari, 2009).
The Importance of PList Examinations
Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it
is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar
information in Mac OS X as they would find on the more common Windows machines.
Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first
explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless
networks, internet history, and third party software, all information that can make forensic evidence a success
or a failure (Farmer, n.d.).
Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for
the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos,
2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods,
devices running iOS have always proved challenging to extract data from, and they seem designed to keep
the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a
passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it
(Farley, 2019).
Acquiring iOS Devices and Acquisition Tools
Phone Identification
During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model
is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the
printed model number. There are other methods, also. Even if the device is locked, information can still be
obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS
version, hardware model and telephony capability to be shown.
FRN 4302, Digital Forensics Applications 3
UNIT x STUDY GUIDE
Title
The Device’s Operating Mode
It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let
an investigator know which mode should be operated to extract data. IOS devices can be operated in three
modes:
• Normal mode,
• Recovery mode, and
• DFU mode.
Breaking iOS Passcodes
There are various methods and tools available to break an iOS device’s passcode, and these are generally
dependent on the iOS version on the device. These tools are a mixture of commercial and open-source
technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source).
Directly Acquiring an iOS Device
A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down
certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac
workstation and browsing the information needed.
Logical Acquisition
Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process
that already exists on the Apple operating system. Evidence contained within vital files can be extracted and
analyzed efficiently via logical acquisition (Proffitt, 2012).
Summary
IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it
very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s
loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to
develop innovating operating systems that prove challenging to forensic investigations. Digital forensic
professionals of all disciplines should be prepared to overcome whatever these challenging new innovations
are.
References
Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS.
https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing-
data-volatile-memory-33049
Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York
Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html
Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.
https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf
D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely
conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on
System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819
Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.
http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/
Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.
https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry
FRN 4302, Digital Forensics Applications 4
UNIT x STUDY GUIDE
Title
Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium.
https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd
Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-
size/
Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating
system. In Digital Forensics and Cyber Crime (pp. 175–180).
http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm
Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.
https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics
Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.
https://www.dataforensics.org/mac-os-x-forensics-analysis/
Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/
Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-
room/whitepapers/forensics/forensic-analysis-ios-devices-34092
Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].
https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd
Learning Activities (Nongraded)
Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit
them. If you have questions, contact your instructor for further guidance and information.
To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter
12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you
an opportunity to test yourself and then give feedback on your answers.
– Course Learning Outcomes for Unit VII
– Required Unit Resources
– Unit Lesson
– Introduction
– The Importance of Mac Forensics
– The Apple File System: Hierarchical File System (HFS and HFS+)
– Virtual Memory Anti-Forensic Tools
– The Importance of PList Examinations
– Acquiring iOS Devices and Acquisition Tools
– Phone Identification
– The Device’s Operating Mode
– Breaking iOS Passcodes
– Directly Acquiring an iOS Device
– Logical Acquisition
– Summary
– References
– Learning Activities (Nongraded)
**## VII.docx**
For this assignment, you are asked to prepare a reflection paper. Based on the course concepts we have covered thus far, reflect on three of the major concepts discussed in the readings, and write about those concepts. You should pick one concept related to mobile forensics, one related to forensics tools, and one related to network forensics. How do those concepts relate to the subject of digital forensics as a whole? How have those concepts affected digital forensics in the past? How will the concepts affect digital forensics in the future? Wil these concepts affect you in your career? Why, or why not?
The purpose of this assignment is to provide you with an opportunity to reflect on the material that you have read and to expand on your reading.
The writing that you submit must meet the following requirements:
· at least two pages in length,
· include your thoughts about the major concepts that you select,
· explain how the concepts impact digital forensics, and
· explain how the concepts apply to your career.
References are not required for this assignment, but if outside sources are used, please adhere to APA Style when creating citations and references for this assignment.
**## UnitVII.pdf**
FRN 4302, Digital Forensics Applications 1
Course Learning Outcomes for Unit VII
Upon completion of this unit, students should be able to:
5. Utilize forensic toolkits for evidence forensics enumeration.
5.1 Explore the Macintosh operating system.
5.2 Use forensics tools to complete tasks on a Macintosh system.
Required Unit Resources
Chapter 12: Mac Forensics
Unit Lesson
Introduction
In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become
an important forensic discipline. You have developed knowledge of how a cellular network operates and the
evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should
also now be aware of some of the gray areas that exist in terms of legal considerations when conducting
mobile device investigations.
Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an
introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into
virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and
hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of
how to examine Apple mobile devices.
The Importance of Mac Forensics
Apple is a unique company and one that does not take to being told how to act in terms of security (Benner &
Mozur, 2016). The devices they produce are popular because of their level of performance as well as the
security aspects they offer.
It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If
we assume that this equates to the proportion of actual criminal activity that is being conducted, the
importance of the Mac in digital forensics cannot be underestimated.
The Apple File System: Hierarchical File System (HFS and HFS+)
This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the
significance of this system in digital forensics. When any device is seized, the data and information within it
may or may not have been deleted. The forensic investigator needs to recover the data regardless of the
state it is in.
Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space,
and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a
haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which
adopts functionality that assists in searching for data whether it has been deleted or not.
UNIT VII STUDY GUIDE
Mac Forensics
FRN 4302, Digital Forensics Applications 2
UNIT x STUDY GUIDE
Title
One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata
that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and
how to search this metadata can assist in the recovery of deleted data and, therefore, advance an
investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can
hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression
means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).
Virtual Memory Anti-Forensic Tools
Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines
virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the
operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time-
frame requirements. The exception is when the user cooperates and provides their log-in details. The ability
to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any
other additional volumes created by the user. Each custom volume can be protected by its own specific
username and password (Leopard et al., 2015).
Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic
evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata
overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic
investigators today (D’Orazio et al., 2014).
This has led to a different approach being adopted for forensic evidence, involving acquiring main memory
and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network
packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile
memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through
memory analysis (Amari, 2009).
The Importance of PList Examinations
Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it
is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar
information in Mac OS X as they would find on the more common Windows machines.
Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first
explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless
networks, internet history, and third party software, all information that can make forensic evidence a success
or a failure (Farmer, n.d.).
Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for
the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos,
2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods,
devices running iOS have always proved challenging to extract data from, and they seem designed to keep
the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a
passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it
(Farley, 2019).
Acquiring iOS Devices and Acquisition Tools
Phone Identification
During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model
is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the
printed model number. There are other methods, also. Even if the device is locked, information can still be
obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS
version, hardware model and telephony capability to be shown.
FRN 4302, Digital Forensics Applications 3
UNIT x STUDY GUIDE
Title
The Device’s Operating Mode
It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let
an investigator know which mode should be operated to extract data. IOS devices can be operated in three
modes:
• Normal mode,
• Recovery mode, and
• DFU mode.
Breaking iOS Passcodes
There are various methods and tools available to break an iOS device’s passcode, and these are generally
dependent on the iOS version on the device. These tools are a mixture of commercial and open-source
technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source).
Directly Acquiring an iOS Device
A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down
certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac
workstation and browsing the information needed.
Logical Acquisition
Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process
that already exists on the Apple operating system. Evidence contained within vital files can be extracted and
analyzed efficiently via logical acquisition (Proffitt, 2012).
Summary
IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it
very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s
loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to
develop innovating operating systems that prove challenging to forensic investigations. Digital forensic
professionals of all disciplines should be prepared to overcome whatever these challenging new innovations
are.
References
Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS.
https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing-
data-volatile-memory-33049
Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York
Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html
Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.
https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf
D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely
conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on
System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819
Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.
http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/
Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.
https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry
FRN 4302, Digital Forensics Applications 4
UNIT x STUDY GUIDE
Title
Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium.
https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd
Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-
size/
Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating
system. In Digital Forensics and Cyber Crime (pp. 175–180).
http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm
Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.
https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics
Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.
https://www.dataforensics.org/mac-os-x-forensics-analysis/
Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/
Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-
room/whitepapers/forensics/forensic-analysis-ios-devices-34092
Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].
https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd
Learning Activities (Nongraded)
Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit
them. If you have questions, contact your instructor for further guidance and information.
To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter
12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you
an opportunity to test yourself and then give feedback on your answers.
– Course Learning Outcomes for Unit VII
– Required Unit Resources
– Unit Lesson
– Introduction
– The Importance of Mac Forensics
– The Apple File System: Hierarchical File System (HFS and HFS+)
– Virtual Memory Anti-Forensic Tools
– The Importance of PList Examinations
– Acquiring iOS Devices and Acquisition Tools
– Phone Identification
– The Device’s Operating Mode
– Breaking iOS Passcodes
– Directly Acquiring an iOS Device
– Logical Acquisition
– Summary
– References
– Learning Activities (Nongraded)
**## VII.docx**
For this assignment, you are asked to prepare a reflection paper. Based on the course concepts we have covered thus far, reflect on three of the major concepts discussed in the readings, and write about those concepts. You should pick one concept related to mobile forensics, one related to forensics tools, and one related to network forensics. How do those concepts relate to the subject of digital forensics as a whole? How have those concepts affected digital forensics in the past? How will the concepts affect digital forensics in the future? Wil these concepts affect you in your career? Why, or why not?
The purpose of this assignment is to provide you with an opportunity to reflect on the material that you have read and to expand on your reading.
The writing that you submit must meet the following requirements:
· at least two pages in length,
· include your thoughts about the major concepts that you select,
· explain how the concepts impact digital forensics, and
· explain how the concepts apply to your career.
References are not required for this assignment, but if outside sources are used, please adhere to APA Style when creating citations and references for this assignment.
**## UnitVII.pdf**
FRN 4302, Digital Forensics Applications 1
Course Learning Outcomes for Unit VII
Upon completion of this unit, students should be able to:
5. Utilize forensic toolkits for evidence forensics enumeration.
5.1 Explore the Macintosh operating system.
5.2 Use forensics tools to complete tasks on a Macintosh system.
Required Unit Resources
Chapter 12: Mac Forensics
Unit Lesson
Introduction
In Unit VI, you learned about mobile forensics and how the field developed from simple beginnings to become
an important forensic discipline. You have developed knowledge of how a cellular network operates and the
evidence procedures involved with mobile devices; and what types of evidence can be gathered. You should
also now be aware of some of the gray areas that exist in terms of legal considerations when conducting
mobile device investigations.
Unit VII will cover Mac forensics. In this unit, you will learn the importance of Mac forensics and get an
introduction into the Apple file systems of Hierarchical File System (HFS) and HFS+. You will also delve into
virtual files on a Macintosh computer; property lists (PLists) and their value to investigators; and
hardware/software forensics tools for Macintosh computers and iOS devices. Finally, you will learn a little of
how to examine Apple mobile devices.
The Importance of Mac Forensics
Apple is a unique company and one that does not take to being told how to act in terms of security (Benner &
Mozur, 2016). The devices they produce are popular because of their level of performance as well as the
security aspects they offer.
It is estimated that around 5 to 10% of the systems in crime labs are running a Mac OS X (Mendis, 2017). If
we assume that this equates to the proportion of actual criminal activity that is being conducted, the
importance of the Mac in digital forensics cannot be underestimated.
The Apple File System: Hierarchical File System (HFS and HFS+)
This unit is too short to go into the technical details of the Apple filing system, but it aims to highlight the
significance of this system in digital forensics. When any device is seized, the data and information within it
may or may not have been deleted. The forensic investigator needs to recover the data regardless of the
state it is in.
Storage on Macs, like other devices, can be in excess of terabytes (Knight, 2014). This is a massive space,
and knowing where to look is important if the investigator is to find the digital equivalent of a needle in a
haystack. However, certain file systems can make this easier. One such system is Apple’s HFS+, which
adopts functionality that assists in searching for data whether it has been deleted or not.
UNIT VII STUDY GUIDE
Mac Forensics
FRN 4302, Digital Forensics Applications 2
UNIT x STUDY GUIDE
Title
One piece of this functionality is called journaling. HFS(+) uses journaling to track the information’s metadata
that relates to specific transaction groups. A forensic investigator’s knowledge and experience of where and
how to search this metadata can assist in the recovery of deleted data and, therefore, advance an
investigation (Ware, 2012). It is also important in the respect of having no knowledge of this technique can
hold back an investigation. For instance, using forensic tools that are not aware of HFS+ file compression
means they will be unable to view any data relating to a compressed file (Craiger & Burke, 2005).
Virtual Memory Anti-Forensic Tools
Two of Apple’s most recent operating systems now include anti-forensic features for encrypting the machines
virtual memory and any user data (Leopard et al., 2015). It is now possible for Apple users to encrypt the
operating system, making it nearly impossible for the recovery of forensic evidence in line with any legal time-
frame requirements. The exception is when the user cooperates and provides their log-in details. The ability
to encrypt users’ data can be accomplished anywhere data is stored within the operating system and any
other additional volumes created by the user. Each custom volume can be protected by its own specific
username and password (Leopard et al., 2015).
Traditionally, a straightforward approach to computer forensic investigations was adopted to acquire forensic
evidence. However, anti-forensic features of current Apple systems, such as secure data deletion, metadata
overwriting, trail obfuscation, and detection avoidance make things much more difficult for forensic
investigators today (D’Orazio et al., 2014).
This has led to a different approach being adopted for forensic evidence, involving acquiring main memory
and other volatile data systems whilst they are live. Memory forensics, as this is known, allows network
packets, encryption keys, hidden processes, injected code, and communications to be recovered from volatile
memory (Lord, 2018). Additionally, any viruses that reside in the memory may only become evident through
memory analysis (Amari, 2009).
The Importance of PList Examinations
Mac computers are a very popular and aspirational product and enjoy a cult-like following. For some people, it
is a Mac or nothing. Therefore, it is important to understand where forensic investigators can find similar
information in Mac OS X as they would find on the more common Windows machines.
Property lists (PLists) on a Mac are very similar to those on a Windows registry. These locations were first
explored in 2007 for areas of Windows machines pertaining to autorun locations, recent items, wireless
networks, internet history, and third party software, all information that can make forensic evidence a success
or a failure (Farmer, n.d.).
Apple describes the PList as organizing data into a structure of names, lists, and object types. This allows for
the creation of a structure that is accessible, storable, transportable, and is as efficient as possible (Karaiskos,
2018). Effectively, the PList is the registry of the Mac OS X. Because of Apple’s tough encryption methods,
devices running iOS have always proved challenging to extract data from, and they seem designed to keep
the forensic investigator out (Farley, 2019). The arrival of an iPhone on an instigator’s desk without a
passcode, could lead to a long delay in an investigation unless they have the correct tools to deal with it
(Farley, 2019).
Acquiring iOS Devices and Acquisition Tools
Phone Identification
During the search-and-seizure phases of a digital forensic investigation, it is important that the device’s model
is identified (Packt, 2014). One method of achieving this is to simply look on the back of the device for the
printed model number. There are other methods, also. Even if the device is locked, information can still be
obtained using the ideviceinfo command tool. This would allow the device’s class, name, Wi-Fi address, iOS
version, hardware model and telephony capability to be shown.
FRN 4302, Digital Forensics Applications 3
UNIT x STUDY GUIDE
Title
The Device’s Operating Mode
It is important for the investigator to be aware what operating mode the iOS device is in. Knowing this will let
an investigator know which mode should be operated to extract data. IOS devices can be operated in three
modes:
• Normal mode,
• Recovery mode, and
• DFU mode.
Breaking iOS Passcodes
There are various methods and tools available to break an iOS device’s passcode, and these are generally
dependent on the iOS version on the device. These tools are a mixture of commercial and open-source
technology; and include the UFED lock recovery tool (commercial) and a Python script (open-source).
Directly Acquiring an iOS Device
A very simple method to acquire data from an iOS device, when it is not locked or when the lock-down
certificate data is known, is iDevice browser. It simply involves attaching the device to the forensics Mac
workstation and browsing the information needed.
Logical Acquisition
Recovery and analysis of active files on an iOS device can be achieved through synchronization, a process
that already exists on the Apple operating system. Evidence contained within vital files can be extracted and
analyzed efficiently via logical acquisition (Proffitt, 2012).
Summary
IOS devices are very popular, and their cult-like followers will often use nothing else. Their popularity makes it
very likely that a digital forensics’ investigator will have to deal with iOS devices on a routine basis. Apple’s
loyalty to their customers and their willingness to say “No” to convention will surely lead to continued efforts to
develop innovating operating systems that prove challenging to forensic investigations. Digital forensic
professionals of all disciplines should be prepared to overcome whatever these challenging new innovations
are.
References
Amari, K. (2009). Techniques and tools for recovering and analyzing data from volatile memory. SANS.
https://www.sans.org/reading-room/whitepapers/forensics/techniques-tools-recovering-analyzing-
data-volatile-memory-33049
Benner, K., & Mozur, P. (2016, February 20). Apple sees value in its stand to protect security. The New York
Times. https://www.nytimes.com/2016/02/21/technology/apple-sees-value-in-privacy-vow.html
Craiger, P., & Burke, P. K. (2005). Mac forensics: Mac OS X and the HFS+ file system.
https://pdfs.semanticscholar.org/6498/824bf271858bcd2a8fc2fbb0da1de7f77367.pdf
D’Orazio, C., Ariffin, A., & Choo, K-K. R. (2014, January 6–9). iOS anti-forensics: How can we securely
conceal, delete and insert data? [Paper presentation]. 47th Hawaii International Conference on
System Sciences. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2339819
Farley, J. (2019). Forensic analysis of iTunes backups. Farley Forensics.
http://www.farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/
Farmer, D. J. (n.d.). A forensic analysis of the Windows registry. Forensic Focus.
https://www.forensicfocus.com/a-forensic-analysis-of-the-windows-registry
FRN 4302, Digital Forensics Applications 4
UNIT x STUDY GUIDE
Title
Karaiskos, C. (2018, February 27). Understanding Apple's binary property list format. Medium.
https://medium.com/@karaiskc/understanding-apples-binary-property-list-format-281e6da00dbd
Knight, D. (2014). Maximum hard drive size. LowEndMac. https://lowendmac.com/2014/maximum-hard-drive-
size/
Leopard, C. B., Rowe, N. C., & McCarrin, M. R. (2015). Memory forensics and the Macintosh OS X operating
system. In Digital Forensics and Cyber Crime (pp. 175–180).
http://faculty.nps.edu/ncrowe/oldstudents/cleopard_thesis.htm
Lord, N. (2018, September 29). What are memory forensics? A definition of memory forensics. Data Insider.
https://digitalguardian.com/blog/what-are-memory-forensics-definition-memory-forensics
Mendis, E. (2017, October 17). Mac OS X forensics: Collecting and analyzing artifacts. Data Forensics.
https://www.dataforensics.org/mac-os-x-forensics-analysis/
Packt. (2014). Introduction to mobile forensics. https://hub.packtpub.com/introduction-mobile-forensics/
Proffitt, T. (2012). Forensic analysis on iOS devices. SANS. https://www.sans.org/reading-
room/whitepapers/forensics/forensic-analysis-ios-devices-34092
Ware, S. (2012). Hfs plus file system exposition and forensics [Master’s thesis, University of Central Florida].
https://stars.library.ucf.edu/cgi/viewcontent.cgi?article=3166&context=etd
Learning Activities (Nongraded)
Nongraded Learning Activities are provided to aid students in their course of study. You do not have to submit
them. If you have questions, contact your instructor for further guidance and information.
To check your knowledge of what you have learned in this unit, complete the cards and quizzes for Chapter
12. The cards will provide an opportunity to review key terms from the chapters, and the quizzes will give you
an opportunity to test yourself and then give feedback on your answers.
– Course Learning Outcomes for Unit VII
– Required Unit Resources
– Unit Lesson
– Introduction
– The Importance of Mac Forensics
– The Apple File System: Hierarchical File System (HFS and HFS+)
– Virtual Memory Anti-Forensic Tools
– The Importance of PList Examinations
– Acquiring iOS Devices and Acquisition Tools
– Phone Identification
– The Device’s Operating Mode
– Breaking iOS Passcodes
– Directly Acquiring an iOS Device
– Logical Acquisition
– Summary
– References
– Learning Activities (Nongraded)