MacOS Mail Messages And Notes Forensics
MAIL, MESSAGES & NOTESONMACOS · A GUIDE FOR UK LAWYERS macOS Mail, Messages and Notes Forensics The Communication Trail on a Mac, and the iCloud Account That Holds It Too COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the communication trail lives in many copies 03 Where Mail, Messages and Notes store data 04 What survives deletion 05 Recovering and interpreting the content 06 Attribution, edits and honest limits 07 Deployment: proving communications and their timing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: the communication trail on a Mac, in Mail, Messages and Notes, is often richer and longer-lived than people assume, deleted items frequently survive locally and in iCloud, and the same closed.
§ 02 · FIRST PRINCIPLES The problem in plain English: the communication trail lives in many copies
§ 03 · WHERETHEDATALIVES Where Mail, Messages and Notes store data MAIL STORE MESSAGES DB NOTES STORE ICLOUD SYNC PAIRED DEVICES
§ 04 · WHATSURVIVESDELETION What survives deletion
§ 05 · RECOVERINGANDINTERPRETING Recovering and interpreting the content
§ 06 · ATTRIBUTIONANDHONESTLIMITS Attribution, edits and honest limits
§ 07 · DEPLOYMENT Deployment: proving communications and their timing
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LOCAL ICLOUD IPHONE / MAC PAIRED STORE IPAD SNAPSHOTS / SERVER / DELETED / TIME MACHINE COUNTERPART RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDEMAILTHELOCALSTOREKEPT EXAMPLE2 · THEMESSAGESDELETEDONTHEPHONEBUTALIVEONTHEMAC EXAMPLE3 · THENOTETHATHELDWHATMATTERED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAMAIL, MESSAGES AND NOTES ANALYSIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Mail, Messages and Notes checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions An email was deleted from the server. Is it gone? Someone deleted a message conversation. Can it be recovered? Why look at Notes? Can you open a locked note? Does a message prove who sent it? How quickly must we preserve the devices?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, MacOS Mail Messages And Notes Forensics, Computer Forensics Lab, https://e-discovery.uk/library/macos-mail-messages-and-notes-forensics/pdf.