Page 1
SPOTLIGHT & MACOSMETADATA · A GUIDE FOR UK LAWYERS macOS Spotlight and Metadata Deep-Dive The Index That Remembers Files the Mac No Longer Has COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES SPOTLIGHT INDEX ANALYSIS FILE-ORIGIN & METADATA DATING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the index outlives the file 03 How Spotlight and macOS metadata work 04 What the metadata reliably shows 05 Index remnants: evidence of files that have gone 06 Interpretation, origin data and honest limits 07 Deployment: origin, use and the file that left 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Spotlight indexes the files on a Mac with rich metadata, dates, origins and attributes, that index entry may evidence that a deleted or removed file once existed, and where it came from.
§ 02 · FIRST PRINCIPLES The problem in plain English: the index outlives the file
§ 03 · HOW IT WORK S How Spotlight and macOS metadata work FILES INDEX METADATA OR IG IN / DATES REMNANTS
Page 2
§ 04 · WHATTHEMETADATASHOWS What the metadata reliably shows
§ 05 · INDEXREMNANTS Index remnants: evidence of files that have gone
§ 06 · INTERPRETATIONANDHONESTLIMITS Interpretation, origin data and honest limits
§ 07 · DEPLOYMENT Deployment: origin, use and the file that left
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SPOTLIGHT CONNECTION MEDIUM / LIVE DEVICE- EXTERNAL INDEX LOGS ESTATE SNAPSHOTS / SYSTEM DELETED / BACKUPS ARTEFACTS DEPARTED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEINDEXTHATPROVEDTHEFILEHADBEENTHERE EXAMPLE2 · THEORIGINMETADATATHATFIXEDPROVENANCE EXAMPLE3 · THEATTRIBUTEREADFOREXACTLYWHATITMEANT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORASPOTLIGHTANDME TA DATA ANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Spotlight and metadata checklist Red flags When to involve a digital forensic expert 19. Through cflab.uk and e-discovery.uk, Spotlight and metadata work turns the Mac's own catalogue into
§ 13 · COMMON QUESTIONS Frequently asked questions Can metadata show where a file came from? A file is not on the Mac. Can you still show it was there? Isn't the "created" date just when the document was written? How reliable is the origin ("where from") data? Does an index entry prove someone intended to do something? How urgent is preserving the Mac for this?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, MacOS Spotlight And Metadata Deep Dive, Computer Forensics Lab, https://e-discovery.uk/library/macos-spotlight-and-metadata-deep-dive/pdf.