macOS Forensics: Applications

In modern operating systems, users use applications to perform different activities. Therefore, when performing forensics, it is imperative to learn about the forensic artefacts created using various applications to fully understand user activity. In this room, we will learn about the forensic artefacts related to applications in macOS. 

Learning Objectives:

• Leverage application data to perform forensic analysis on a Mac device.
• Explore persistence mechanisms in macOS.
• Identify user activity in built-in apps such as mail, calendar, phone, and messages.

Prerequisites:

Before starting this room, it is highly recommended that you complete:

• macOS Forensics: The Basics
• macOS Forensics: Artefacts

Please note that, similar to the previous room, this room requires advanced knowledge of the Linux command line and an understanding of the tools and techniques used in the earlier rooms.

Machine Access

Before moving forward, please press the Start Lab Machine button below to start the attached VM.

The machine will open in split view. The attached machine is a Linux machine with a macOS disk image named mac-disk.img. The image is placed in the home directory. As we learned previously, we will mount this disk image using the apfs-fuse utility and perform analysis on the image.

In the coming tasks, we will demonstrate the artefacts on a live Mac machine and practice analysing them on the disk image in the attached Linux VM. Instructions will be provided on accessing the artefacts in the Linux VM if they differ from those in a live machine.