Page 1

ENTERPRISE MANAGEMENT & MDM · A GUIDE FOR UK LAWYERS macOS Enterprise Management and MDM Artefacts The Managed Mac: Central Control, Central Records, and the Route Around a Locked Device COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANAGED-DEVICE ACCESS & LOGS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the managed Mac is not alone 03 How managed Macs and MDM work 04 Management artefacts on the device 05 What the MDM console holds 06 Lawful access, authority and honest limits 07 Deployment: evidence, access and the locked device 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: most workplace Macs are managed through MDM, which leaves artefacts on the device device.

§ 02 · FIRST PRINCIPLES The problem in plain English: the managed Mac is not alone

§ 03 · HOW IT WORK S How managed Macs and MDM work ENROL PROFILES DEPLOY CONTROL CONSOLE RECORD