Page 1
MACFORENSICS · A GUIDE FOR UK LAWYERS Mac Evidence in Litigation APFS, File Vault, Time Machine, iCloud and the Artefacts of macOS COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM COURT-EXPERIENCED EXPERT WITNESSES
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac is not a Windows machine in nicer clothes 03 Acquisition: File Vault, Apple Silicon and getting the data at all 04 APFS: snapshots, clones and what deletion means now 05 The macOS artefact map: what the system records 06 Time Machine: the versioned past 07 iCloud: the half of the Mac that lives else where 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: RICHEVIDENCE, DIFFERENTRULES
§ 02 · FIRST PRINCIPLES The problem in plain English: the Mac is not a Windows machine in nicer clothes
§ 03 · THEFRONTDOOR Acquisition: File Vault, Apple Silicon and getting the data at all
Page 2
§ 04 · DELETION, REWRITTEN APFS: snapshots, clones and what deletion means now
§ 05 · THEARTEFACTMAP The macOS artefact map: what the system records QUESTION PRINCIPAL MACOS ARTEFACTS
§ 06 · THEVERSIONEDPAST Time Machine: the versioned past
§ 07 · THE OTHER HALF iCloud: the half of the Mac that lives else where
§ 08 · IN THE WILD Worked examples EXAMPLE1 · THEDESIGNFILESANDTHELOCALSNAPSHOT EXAMPLE2 · THEBACKDATEDAGREEMENTANDTHETIMEMACHINESERIES EXAMPLE3 · THEGENERALISTREPORTANDTHEEMPTYUNALLOCATEDSPACE
§ 09 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
Page 3
§ 10 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR AM AC EXAMIN AT ION
§ 11 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Mac evidence checklist Red flags When to involve a digital forensic expert
§ 12 · COMMON QUESTIONS Frequently asked questions Are Macs harder to examine than Windows machines? Can deleted files be recovered from a Mac? What if the employee will not give up the password? Do Macs record USB sticks the way Windows does? The user's iPhone matters too. Does the Mac help? Our opponent's expert says nothing was recoverable. How do we test that?
§ 13 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Mac Evidence In Litigation, Computer Forensics Lab, https://e-discovery.uk/library/mac-evidence-in-litigation/pdf.