MacOS And Apple Silicon Forensics

MACOS & APPLESILICON · AGUIDEFORUKLAWYERS macOS and Apple Silicon Forensics The Mac That Cannot Be Imaged the Old Way: Encryption, Secure Boot and Live Acquisition COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: no disk to pull 03 How modern Macs store and protect data 04 Why the old imaging approach fails 05 How a Mac is acquired today 06 Credentials, cooperation and honest limits 07 Deployment: preservation, seizure and the estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary hardware-encrypted and its boot is locked down, so it is acquired live and logically on the running, unlocked machine with the credentials obtained by cooperation or lawful compulsion, and what it yields, and does not, is stated honestly. § 0 2 · FIRSTPRINCIPLES The problem in plain English: no disk to pull § 0 3 · HOWITSTORESANDPROTECTSDATA How modern Macs store and protect data SOLDERED FLASH HW ENCRYPTION SECURE ENCLAVE SECURE BOOT ICLOUD § 0 4 · WHYOLDIMAGINGFAILS Why the old imaging approach fails § 0 5 · HOWITISACQUIREDTODAY How a Mac is acquired today § 0 6 · CREDENTIALSANDHONESTLIMITS Credentials, cooperation and honest limits § 0 7 · DEPLOYMENT Deployment: preservation, seizure and the estate § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ICLOUD IPHONE / MACHINE / THE MAC APPLE DELETED / (LIVE) ACCOUNT RECOVERABLE PAIRED TIME IPAD BACKUPS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEMACSWITCHEDOFF , ANDTHELESSONLEARNED EXAMPLE2 · THELIVEACQUISITIONDONERIGHT EXAMPLE3 · THEHONESTLIMITANDTHEESTATETHATANSWERED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAM AC AC QUISITION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Mac acquisition checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can you just image the Mac's hard drive like any other computer? What is the single most important thing when seizing a Mac? Is a live logical acquisition as good as a full image? The Mac is locked and we do not have the password. Can you break in? If we cannot access the Mac, is the evidence lost? Does this apply to older Intel Macs too? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY