Page 1

GATEKEEPER, XPROTECT & MACMALWARE · A GUIDE FOR UK LAWYERS Gatekeeper, XProtect and macOS Malware Artefacts What Ran, What Was Blocked, and Whether "a Virus Did It" Holds Up COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: Macs get malware, and "a virus did it" gets raised 03 How Gatekeeper and XProtect work 04 What the artefacts show: ran, blocked, quarantined 05 Investigating a genuine compromise 06 Testing the "a virus did it" claim 07 Deployment: breach, c a us at i on and the malware defence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Macs get malware, and Apple's Gatekeeper and XProtect leave artefacts showing what ran, was blocked or was quarantined, so those artefacts, with the wider record, both help investigate a genuine compromise and allow the "a virus did it" defence to be tested even-handedly, at honest confidence.

§ 02 · FIRST PRINCIPLES The problem in plain English: Macs get malware, and "a virus did it" gets raised

§ 03 · HOW THEY WORK How Gatekeeper and XProtect work D OWN LOAD QUARANTINE GATEKEEPER XPROTECT RAN / BLOCKED