Mac Evidence In Litigation

MACFORENSICS · AGUIDEFORUKLAWYERS Mac Evidence in Litigation APFS, FileVault, Time Machine, iCloud and the Artefacts of macOS COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM COURT-EXPERIENCED EXPERT WITNESSES § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac is not a Windows machine in nicer clothes 03 Acquisition: FileVault, Apple Silicon and getting the data at all 04 APFS: snapshots, clones and what deletion means now 05 The macOS artefact map: what the system records 06 Time Machine: the versioned past 07 iCloud: the half of the Mac that lives elsewhere 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : RICHEVIDENCE , DIFFERENTRULES § 0 2 · FIRSTPRINCIPLES The problem in plain English: the Mac is not a Windows machine in nicer clothes § 0 3 · THEFRONTDOOR Acquisition: FileVault, Apple Silicon and getting the data at all § 0 4 · DELETION , REWRITTEN APFS: snapshots, clones and what deletion means now § 0 5 · THEARTEFACTMAP The macOS artefact map: what the system records QUESTION PRINCIPAL MACOS ARTEFACTS § 0 6 · THEVERSIONEDPAST Time Machine: the versioned past § 0 7 · THEOTHERHALF iCloud: the half of the Mac that lives elsewhere § 0 8 · INTHEWILD Worked examples EXAMPLE1 · THEDESIGNFILESANDTHELOCALSNAPSHOT EXAMPLE2 · THEBACKDATEDAGREEMENTANDTHETIMEMACHINESERIES EXAMPLE3 · THEGENERALISTREPORTANDTHEEMPTYUNALLOCATEDSPACE § 0 9 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 0 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAM AC EXAMIN AT ION § 1 1 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Mac evidence checklist Red flags When to involve a digital forensic expert § 1 2 · COMMONQUESTIONS Frequently asked questions Are Macs harder to examine than Windows machines? Can deleted files be recovered from a Mac? What if the employee will not give up the password? Do Macs record USB sticks the way Windows does? The user's iPhone matters too. Does the Mac help? Our opponent's expert says nothing was recoverable. How do we test that? § 1 3 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY