MacOS System Artefacts

MACOSSYSTEMARTEFACTS · AGUIDEFORUKLAWYERS macOS System Artefacts Unified Logs, Activity Databases and the Detailed Record of What Was Done, and When COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM 19 with limits such as log rotation stated plainly. ACTIVIT Y TIMELINE RECONSTRUCTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac remembers what was done 03 The principal system artefacts 04 What each artefact reliably shows 05 Building the activity timeline 06 Interpretation, log rotation and honest limits 07 Deployment: proving activity, use and presence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary and many other artefacts, that reconstructs what applications ran, what files were opened, what was searched and when the user was active, answering the who-did-what-when questions at the heart of disputes, provided each artefact is interpreted for what it truly shows. § 0 2 · FIRSTPRINCIPLES The problem in plain English: the Mac remembers what was done § 0 3 · THEARTEFACTS The principal system artefacts UNIFIED LOGS ACTIVITY DB SPOTLIGHT RECENT ITEMS QUICK LOOK / FSEVENTS § 0 4 · WHATEACHSHOWS What each artefact reliably shows § 0 5 · THEACTIVITYTIMELINE Building the activity timeline § 0 6 · INTERPRETATIONANDHONESTLIMITS Interpretation, log rotation and honest limits § 0 7 · DEPLOYMENT Deployment: proving activity, use and presence § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MACHINE / IPHONE / DEVICE MAC LIVE ICLOUD / AGED-OUT / ARTEFACTS ACCOUNT RECOVERABLE TIME PAIRED MANAGED- BACKUPS IPAD CONSOLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEOPENEDFILEANDTHECONNECTEDDRIVE EXAMPLE2 · THEGAPTHATWASROTATION , NOTINNOCENCE EXAMPLE3 · THESEARCHESTHATSHOWEDINTENT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORASYSTEM - ARTE FAC TANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The system-artefact checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can you tell whether someone actually opened a file, not just that it was there? What is KnowledgeC and why is it useful? There are no log entries for the period we care about. Does that clear our opponent? Can the artefacts show what someone searched for? How urgent is preserving the Mac for this kind of evidence? Do the artefacts prove who was using the machine? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY