MacOS And Apple Silicon Forensics
MACOS & APPLESILICON · A GUIDE FOR UK LAWYERS macOS and Apple Silicon Forensics The Mac That Cannot Be Imaged the Old Way: Encryption, Secure Boot and Live Acquisition COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: no disk to pull 03 How modern Macs store and protect data 04 Why the old imaging approach fails 05 How a Mac is acquired today 06 Credentials, cooperation and honest limits 07 Deployment: preservation, seizure and the estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary hardware-encrypted and its boot is locked down, so it is acquired live and logically on the running, unlocked machine with the credentials obtained by cooperation or lawful compulsion, and what it yields, and does not, is stated honestly.
§ 02 · FIRST PRINCIPLES The problem in plain English: no disk to pull
§ 03 · HOWITSTORESANDPROTECTSDATA How modern Macs store and protect data SOLDERED FLASH HW ENCRYPTION SECURE ENCLAVE SECURE BOOT ICLOUD
§ 04 · WHYOLDIMAGINGFAILS Why the old imaging approach fails
§ 05 · HOWITISACQUIREDTODAY How a Mac is acquired today
§ 06 · CREDENTIALSANDHONESTLIMITS Credentials, cooperation and honest limits
§ 07 · DEPLOYMENT Deployment: preservation, seizure and the estate
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE I CLOUD I PHONE / MACHINE / THE MAC APPLE DELETED / (LIVE) ACCOUNT RECOVERABLE PAIRED TIME IPAD BACKUPS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEMACSWITCHEDOFF, ANDTHELESSONLEARNED EXAMPLE2 · THELIVEACQUISITIONDONERIGHT EXAMPLE3 · THEHONESTLIMITANDTHEESTATETHATANSWERED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR AM AC AC QUISITION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Mac acquisition checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you just image the Mac's hard drive like any other computer? What is the single most important thing when seizing a Mac? Is a live logical acquisition as good as a full image? The Mac is locked and we do not have the password. Can you break in? If we cannot access the Mac, is the evidence lost? Does this apply to older Intel Macs too?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, MacOS And Apple Silicon Forensics, Computer Forensics Lab, https://e-discovery.uk/library/macos-and-apple-silicon-forensics/pdf.