Well, we have gone through a lot of trouble acquiring a disk image from a Mac device. How do we go about analysing it? In most cases, forensic investigators will have mostly Linux or Windows machines (or both) to perform forensics on, but they will seldom have a Mac machine. Let's see how challenging it is to mount an APFS Mac disk on a Linux system.
Machine Access
Before moving forward, press the Start Lab Machine button below to start the attached VM.
The attached VM will start in the split view.
APFS-Fuse
To mount an APFS formatted drive on a Linux system, we will use the open-source apfs-fuse utility. This utility can be found on GitHub, along with the installation instructions. We have already installed this utility in the attached VM.
Checking the APFS Container Info
In the attached VM, a Mac disk image is already placed in the home directory with the name mac.dmg. First, we can list all the volumes in the container using the apfsutil tool.
Checking APFS Container
ubuntu@tryhackme:~$ apfsutil mac-disk.img
Found partitions:
69646961-6700-11AA-11AA-00306543ECAC 68CB0FFE-F676-47D6-D1A2-5707D06D3E49 0000000000000028 00000000000FA027 0000000000000000 iBootSystemContainer
7C3457EF-0000-11AA-11AA-00306543ECAC 449DFC0C-7E1F-44D5-6A9F-7EA2C2AF0ADC 00000000000FA028 0000000002800027 0000000000000000 Container
52637672-7900-11AA-11AA-00306543ECAC A9432466-4751-47B7-1BBC-45B7B70465DE 0000000002800028 00000000031FFFD7 0000000000000000 RecoveryOSContainer
First APFS partition is 1
Volume 0 3B2E79F0-E4D4-4017-8443-597659F89844
---------------------------------------------
Role: System
Name: Macintosh HD (Case-insensitive)
Capacity Consumed: 10741764096 Bytes
FileVault: No
Snapshots:
40 : 'com.apple.os.update-151731D20D0972F39B434E2361ADB6B6BDD545C4F7D1DA7F6A031731952B6956'
Volume 1 01B18AFB-06F7-488D-AD2D-7BBA4F662516
---------------------------------------------
Role: Preboot
Name: Preboot (Case-insensitive)
Capacity Consumed: 5790040064 Bytes
FileVault: No
Snapshots:
Volume 2 EB33FEA7-EE13-4296-AC6E-7B52B24C9A55
---------------------------------------------
Role: Recovery
Name: Recovery (Case-insensitive)
Capacity Consumed: 935395328 Bytes
FileVault: No
Snapshots:
Volume 3 37074D60-A2AC-441E-B273-E6C504C58618
---------------------------------------------
Role: Update
Name: Update (Case-insensitive)
Capacity Consumed: 229376 Bytes
FileVault: No
Snapshots:
Volume 4 84E5F2BD-503F-4E3A-8105-EEBEBC1925B4
---------------------------------------------
Role: Data
Name: Data (Case-insensitive)
Capacity Consumed: 2114285568 Bytes
FileVault: No
Snapshots:
Volume 5 93123E81-F23A-48C5-91BF-0E227E15EE6B
---------------------------------------------
Role: VM
Name: VM (Case-insensitive)
Capacity Consumed: 20480 Bytes
FileVault: No
Snapshots:
Here, we can see the different volumes present in the APFS container, along with information such as the capacity consumed, name, UUID, and FileVault status of the different volumes. Now that we know the different partitions in the disk image, let's see how we can mount it.
Mounting Using APFS-Fuse
To mount the drive using apfs-fuse, we need to get root permissions. The instructions to assign read permissions to another user after mounting as root are present in the GitHub readme file, but we will continue just using the root user to read the image for now. Please note that apfs-fuse does not have write capabilities so the image will be mounted as read-only.
apfs-fuse options
ubuntu@tryhackme:~$ sudo su
root@tryhackme:/home/ubuntu# apfs-fuse
apfs-fuse [options] <device> <dir>
Options:
-d level : Enable debug output in the console.
-f device : Specify secondary device for fusion drives.
-o options : Additional mount options (see below).
-v volume-id : Specify number of volume to be mounted.
-r passphrase : Specify volume passphrase. The driver will ask for it if it is
needed and hasn't been specified here.
-s offset : Specify offset to the beginning of the container.
-p partition : Specify partition id containing the container.
-l : Allow driver to return potentially corrupt data instead of
failing, if it can't handle something.
Additional mount options (using -o):
uid=N : Pretend that all files have UID N.
gid=N : Pretend that all files have GID N.
vol=N : Same as -v, select volume id to mount.
blksize=N : Set physical block size. Only needed if a partition table needs
to be parsed and the sector size is not 512 bytes.
pass=... : Specify volume passphrase (same as -r).
xid=N : Mount specific xid.
snap=N : Mount snapshot with given id. Use apfsutil for getting the ids.
We see that apfs-fuse is working, so let's mount the disk image and see what we get. We can mount the image using the mac directory as the mount point.
Mounting APFS image using apfs-fuse
root@tryhackme:/home/ubuntu# apfs-fuse mac-disk.img mac/
root@tryhackme:/home/ubuntu# ls mac
private-dir root
Ok, the image has been mounted, and we can see that it has two directories, root and private-dir. The data is supposed to be present in the root directory. Let's check.
Root directory
root@tryhackme:/home/ubuntu# ls mac/root
Applications Library System Users Volumes bin cores dev etc opt private sbin tmp usr var
root@tryhackme:/home/ubuntu#
Okay, it looks like we have the data. Let's check the Users directory.
Users Directory
root@tryhackme:/home/ubuntu# ls mac/root/Users
root@tryhackme:/home/ubuntu#
Oops! Something isn't right. There should be at least one user in the Users directory. What can be the problem?
Remember the different volumes that we saw when we ran the apfsutil command? It looks like we might have mounted the wrong volume. Let's try again, and this time, let's mount the Data volume. As we can see from the output of apfsutil, the Data volume is volume 4 in the container.
Mounting the Data Volume
root@tryhackme:/home/ubuntu# apfs-fuse -v 4 mac-disk.img mac
root@tryhackme:/home/ubuntu# ls mac/root/Users
Shared thm
root@tryhackme:/home/ubuntu#
In the above command, we have used the -v flag to tell apfs-fuse to mount volume number 4. And voila! We can see that the user data is present now. Let's explore the rest of the image, see what else we can find, and answer the questions below.