This talk was presented by Michael Harvey from Avansic.
This has little to do with my day job, but I am big fan of Mac and have really enjoyed using it for the last several years both personally and professionally. Security tools are also really great for the Apple platform, which I use using Mac Ports: nmap, wireshark, fping, metasploit… Enough about me, on to the talk.
There is a lot of objection about doing forensics on Macs and it is really needed, but in reality it is about 10% of the compute base and a lot of higher level officers in a company are using Macs because they can do whatever they want and aren’t subject to IT restrictions.
Collection of data is the most important. In a Mac, just pulling the hard drive can be difficult. Might be useful to pre-download the PDFs on how to do this. You want to use a firewire write-blocker to copy the drive. Live CDs (Helix and Raptor LiveCD) lets you copy the data and write block. Michael really likes Raptor because of its support for legacy Macs and Intel based Macs. In a follow-up conversation with him he emphasized how Raptor is great for people that don’t do forensics all the time.
Forensics cares about Modified, Accessed, Created time stamps. Macs add on a time stamp called “Birth Time.” This is the real created date. Look at the file properties. You can use SleuthKit (Open Source forensics tool) to assemble a timeline with M-A-C and Birth Time.
Macs use .plist files in lieu of the windows registry that most people are familiar with. “Property List” files. These can be ASCII, XML and Binary. ASCII is pretty rare these days for plist files. Macs more often dont use the standard epoch unix time and instead uses Jan 1, 2001. Michael is releasing information on plist format. Right now there is not a lot of documentation on it. Plist is more or less equivalent to the windows registry.
Two ways to analyze plist: plutil.pl and Plist Edit Pro.
Dmg files. Disk images, similar to iso or zip files. Pretty much a dmg file is crucial for using a Mac. We can keep an eye out for past-used dmg files to know what has been installed or created…
SQLite Databases. Lightweight SQL database. This is heavily used by Firefox, iPhone, or Mac apps. This is real common on Macs.
Email. Email forensics will usually come in three flavors: MS Entourage (Outlook), Mail.app, and Mozilla Thunderbird. A good tool for this is Emailchemy and is forensically sound. It takes in all the formats.
Useful plist File Examples to look at for more info
- Installed Applications: ~/Library/Preferences/com.apple.finder.plist
- CD/DVD Burning: ~/Library/Preferences/com.apple.DiskUtility.plist
- Recent Accessed Docuents, Servers, and Aplications: ~/Library/Preferences/com.recentitems.plist
- Safari History: ~/Library/Preferences/com.apple.Safari.plist
- Safari Cache: ~/Library/Preferences/com.apple.Safari/cache.db
- Firefox: didn’t get this one
Forensic Software that you can use
- AccessData FTK3
- Mac Forensics Lab
- Sleuth Kit (great timeline)
- Others exist
In conclusion, Mac OSX Investigations are not that scary. Be prepared with hard drive removal guides and how to extract data off of them. The best forensic imaging tool out there should be chosen by hardware speed (and firewire), write-blocking capabilities, ability to use dual-core. You need to know your tools handle HFS+, Birthed times, plist files, dmg files, SQLite Databases.
Audience member asked about harddrive copying tool. Michael recommends Tableau (sp?).
Here are some resources:
- Apple Examiner – appleexaminer.com
- Mac Forensics Lab Tips – macforensicslab.com
- Access Data – accessdata.com
- Emailchemy – weirdkid.com/products/emailchemy
File Juicer. Extracts info from databases used by browsers for cache. Favicons are a good browser history tool… You can point File Juicer at a SQLite Database or .dmg files.
Also, talking with Michael afterward ended with two book recommendations: SysInternals for Mac OSX and Mac OSX Forensics (unsure of title but it includes a DVD).
All in all, a really interesting talk and I look forward to seeing what else Mike produces in this arena.
the agile admin 