Page 1
MACOSSYSTEMARTEFACTS · A GUIDE FOR UK LAWYERS macOS System Artefacts Unified Logs, Activity Databases and the Detailed Record of What Was Done, and When COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 19 with limits such as log rotation stated plainly. ACTIVIT Y TIMELINE RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac remembers what was done 03 The principal system artefacts 04 What each artefact reliably shows 05 Building the activity timeline 06 Interpretation, log rotation and honest limits 07 Deployment: proving activity, use and presence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary and many other artefacts, that reconstructs what applications ran, what files were opened, what was searched and when the user was active, answer in g the who-did-what-when questions at the heart of disputes, provided each artefact is interpreted for what it truly shows.
§ 02 · FIRST PRINCIPLES The problem in plain English: the Mac remembers what was done
§ 03 · THEARTEFACTS The principal system artefacts UNIFIED LOGS ACTIVITY DB SPOTLIGHT RECENT ITEMS QUICK LOOK / FSEVENTS
Page 2
§ 04 · WHATEACHSHOWS What each artefact reliably shows
§ 05 · THEACTIVITYTIMELINE Building the activity timeline
§ 06 · INTERPRETATIONANDHONESTLIMITS Interpretation, log rotation and honest limits
§ 07 · DEPLOYMENT Deployment: proving activity, use and presence
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MACHINE / IPHONE / DEVICE MAC LIVE ICLOUD / AGED-OUT / ARTEFACTS ACCOUNT RECOVERABLE TIME PAIRED MANAGED- BACKUPS IPAD CONSOLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEOPENEDFILEANDTHECONNECTEDDRIVE EXAMPLE2 · THEGAPTHATWASROTATION, NOTINNOCENCE EXAMPLE3 · THESEARCHESTHATSHOWEDINTENT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR A SYSTEM - ARTE FAC TANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The system-artefact checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you tell whether someone actually opened a file, not just that it was there? What is Knowledge C and why is it useful? There are no log entries for the period we care about. Does that clear our opponent? Can the artefacts show what someone searched for? How urgent is preserving the Mac for this kind of evidence? Do the artefacts prove who was using the machine?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, MacOS System Artefacts, Computer Forensics Lab, https://e-discovery.uk/library/macos-system-artefacts/pdf.