MacForensicsLab

Creating a Disk Image

When creating a disk image, the examiner can do so directly from either a partition or device, although it is recommended that copies be made of an entire device rather than of individual partitions.

Having selected the respective device or partition from the ‘Device’ panel, the examiner must select the Acquire function, bringing the function window to the fore.

>In performing an acquisition the examiner can set a number of options:

Segment Size – This refers to the amount of data on each acquired image, thus allowing the examiner to separate his or her acquisition into multiple images. Each segment can then be limited to a specific data size, thus allowing for easier backup, for example, if the examiner plans to burn the image to a set of DVDs. To do so the examiner need only select the “4.36 GB (DVD-R/DVD+R)” option from the popup list.

Packet Size – Refers to data intervals at which MacForensicsLab will perform a checksum validation on the data being written to the acquisition image. A lower setting means many more checksum verifications are performed, thus improving overall data integrity but reducing the overall speed of the acquisition.

Smeared Image – Allows the examiner to generate an image from a drive that cannot, or perhaps that he or she may not wish to be unmounted. This would apply for example, when the examiner wishes to acquire the main volume on an operational file server that cannot be taken offline to avoid alerting users to the actions of the examiner.

Golden Master – In addition to the working copy, this option allows the examiner to save an extra disk image copy for other purposes. When the Golden Master option is selected, the user will be prompted to choose a save location twice before the acquisition is made. Once to select a location for the disk image, and the second time to choose the location for the golden master. This allows the user to save the golden master to a different location then that of the working image.

Resume – Provides the examiner with the option to continue on from a previous acquisition, if, for whatever reason, the prior acquisition process was interrupted. This means that the ‘Open’ dialog window rather than the ‘Save’ dialog window will appear when the acquisition is initiated. Select the previous acquisition image from the ‘Open’ dialog to continue the acquisition.

Having made the desired changes to the presets, click the Start button to begin the acquisition process. This will bring up a ‘Save file’ dialog box, if creating the image rather than resuming, and the examiner will be prompted to enter a filename for the disk image. By default the file name appears as “Disk Image”, select and edit this to a preferred name and then chose a location into which to save the disk image. The click Save and the process will begin.

Note: Always be sure to save the disk image to a location other than that which one is creating an image of. Also, make sure that the device one is saving the new disk image to has enough storage space. The acquisition of a 60GB hard drive will require the destination disk to have a minimum of 60GB of free capacity.

Unless the “Create a Smeared Image” option has been selected, MacForensicsLab will first attempt to unmount the selected volume or volumes of the selected device. A status bar then marks the progress of the acquisition, along with a variety of other information. This information includes: checksum mismatch total; total bad blocks; total data remaining to be copied; total data copied; total capacity; approximate current data transfer rate; and total time remaining until acquisition completed.

During the process of acquisition a DAT file is created in the same location as the image file, and contains checksum data for the disk image. It is a small file and takes up less than 25 KB of space and is deleted after the acquisition process is complete.

Once completed, a dialog window will notify the examiner of such and will provide them with an error count. The examiner should simply take note of this and then close the dialog box by clicking Close, returning to the ‘Main’ window. The disk image can then be found in the previously specified location. By default the disk image file/ segments will be locked, thus avoiding the opportunity to further modify or to delete it/them.

Attaching Disk Images

Once an image file or segment has been created, the examiner will want to prepare it for analysis. In order to do this the examiner must attach the disk image and mount it in the Finder.

To access the disk image, while in the ‘Main’ window, select “Attach Disk Image” from the File menu; the Attach Disk Image dialog box will appear. Click the Select button to choose the disk image to mount. There are two options listed for attaching the image.

Use Shadow File – This option will mount the disk image using a shadow file which emulates the disk being writable without actually writing to the disk image itself.

Ignore Permissions – This option turns on the feature in the Finder that maintains all disk permissions but ignores them, giving you access to any user files on all parts of the image.

Once you have selected the desired disk image and options, click the Attach button.

Using this method avoids the need to unlock and lock the image file from the Finder. After mounting disk images, the examiner may need to force MacForensicsLab to rescan for new devices or images; this can be done either by selecting “Rescan Bus” from the File menu, or with the keyboard shortcut [Command] + [R].

It should be noted that if the examiner is using Anti-Virus software, it may be configured to scan all newly attached disks, this includes disk images as they are brought into MacForensicsLab. This process will slow the mounting of the image.

To detach a disk image after analysis, select the item from the ‘Device’ panel in the ‘Main’ window, followed by “Detach” from the File menu.

The Search Function

This section will discuss the search functionality of MacForensicsLab.

The section contains the following information:

• Overview
• The Search Window Layout
• Using Custom Search Terms and Filters
• Performing The Search Operation

Overview

There will come a point in the case when an examiner may wish to analyze the file data block-by-block; the ‘Analyze’ function enables that to be done. Once analysis has been performed and evidence located, the examiner can then export and/or hash the requisite section of the drive to file for safekeeping and later use or further analysis.

The Analyze Window Layout

The analysis window can be split into 4 core sections:

1. ‘Hex Content’ pane
2. ‘Search Items’ pane
3. ‘Found’ pane
4. ‘Carve’ pane

The Hex Content Pane

The ‘Hex Content’ pane is the right-hand side of the ‘Analyze’ window and is where the examiner can read block data piece by piece in ‘Hex’ mode. Starting from MacForensicsLab 3.0, this area has been expanded to display a block at a time with the default view being ASCII.

Search Items Pane

The ‘Search Items’ pane contains a number of elements that are of use to the examiner:

Search Fields Pane – This is the first element in the Search Items Pane, which contains the working list of search terms (or filters) with which to analyze the data blocks. This is split into 2 columns: type and value. Type refers to whether the string that should be pattern matched against the HEX content or the text (ASCII) content of the blocks. Value refers to the content of the string that is going to be pattern matched against the said format blocks, usually a word.

As previously mentioned, MacForensicsLab has the ability to handle foreign language multi-byte character sets such as those used in Russian, Arabic and Oriental languages when searching. The number of characters in a search can be up to 128. The number of search keywords is 128 as well. Search Fields Management Buttons – Below the ‘Search Fields’ pane are buttons to manage the search fields in that pane.

• Clear: to clear all of the search fields in the window above
• Import: to bring up a dialog box and import a search terms database file
• Plus (+): to manually add individual search fields
• Minus (-): to individually delete each selected search field

Quick Tip: Saving Search Fields
The ‘Search Fields’ in the ‘Analyze’ window are retained from one investigative session to the next.

Found Pane

The ‘Found’ pane permits the examiner to very quickly and easily access any of the hits that are generated as a result of the terms used in the search. To view a specific block entry in the ‘Hex Content’ pane, click on the individual result item and the block data will load into the Hex viewer in the main panel.

Search File Data

When investigating files with the ‘Analyze’ window it is possible for the examiner to search for strings within the blocks of data that make up the file.

Individual Search Terms

To do so, the examiner must click the (+) button below the ‘Search Items’ pane; this will add a new field. After this, the examiner should define the search term type (text or hex) by clicking the up/down arrows in the center of the search term row, followed by typing in a unique search term string in the text entry field to the right hand side of the arrows.

This can be repeated multiple times, building up as complex a filter mechanism as desired. If items are added in error, an item can easily remove them by selecting each one in turn and then clicking the (-) button located under the ‘Search Items’ pane. When ready, the examiner can proceed by clicking Search. While processing the data, the examiner will see a progress bar, and upon completion of the search the results will appear in the ‘Found’ pane.

Importing Custom Search Lists

Though an examiner might find it useful to create search terms in an ad hoc manner as discoveries in the investigation necessitate, at some point he or she will want a more in-depth search, based on hundreds, if not thousands of search terms. The best way to achieve this is to importing custom search lists.

Custom search lists are essentially ‘CSV Text’ files with each individual search term on a new line. Custom search lists are also a great way to keep a database of useful terms and makes running a productive analysis or cataloguing on a suspect device a process that is no more than just a few clicks away from getting started.

To import a list, click on the Import button to the middle of the ‘Search Items’ drawer. This will bring up a ‘Find File’ dialog box. Once the examiner has found the file, click ‘Open’.

Each individual line item will then appear as an individual term in the ‘Search Items’ pane. The examiner then has to define whether each term is in Text or HEX format, though they are all imported as and predefined as ASCII Text format content by default.

Credit Card and Social Security Number Search

By selecting the respective checkboxes below the ‘Search Items’ pane it is possible for the examiner to get MacForensicsLab to look for and find credit card and social security numbers during the search process.

Performing the Search

Once the search items have been defined in the ‘Search Items’ pane, either individually or by import, and when the other settings have been defined, the examiner need only click the now enabled Search button to perform the search. Once the scan is complete the results will appear in the ‘Found’ pane. Clicking on any hit displayed in the ‘Found’ pane will display the location of that hit in the ‘Hex Content’ pane and highlight it. The block number it is found in will be displayed in at the bottom of the ‘Hex Content’ pane in the Block Number field. The start and length of the hit will also be populated in the Carve section.

Examining Results of a Search

Once the search has completed (1), the resulting hits are displayed in the ‘Found’ section of the Analyze window. The user may examine these hits by clicking on them (2) and the hit location will be displayed in the ‘Hex Content’ section of the window (3). When clicked, the search hit will turn red and a check mark will appear next to it. This allows the examiner to see which results they have reviewed and which ones they have yet to review, saving them time by making sure they don’t re-examine search hits.

Carving Data

When the examiner is ready to export the block-set being analyzed, he or she can do so very easily by clicking the “Carve” button. Doing so will then invoke the ‘Save’ window, bringing it to the fore.

The examiner may use the Start and Length fields to define the starting byte and the number of bytes after it to be carved out. These values can be changed by either entering the desired number in the Start and Length fields or by pressing the up and down arrows to the right of those fields. Clicking the Locked boxes to the right of these fields will lock the field to prevent it from being changed.

It is advisable to rename the default export filename and to apply a suffix to the name so that Mac OS or any other operating system can more easily recognize the expected file type and open it with the appropriate application.

Upon completion a message will pop to the fore and the user can simply close this and continue on with the investigation.

Overview

MacForensicsLab uses bookmarks to assist the examiner in collecting files of investigative interest. It is possible to bookmark files and directories for reference and examination at a later time in the case. Likewise, the examiner can bookmark any file or folder, or groups of files. You cannot bookmark devices or specific blocks within a device.

Locating the Bookmarks

The bookmarks can be viewed and managed from the Bookmarks window and are accessible at any time by selecting Show All Bookmarks from the Bookmarks menu, or by using the keyboard shortcut [Command] + [Option] + [B].

The Bookmark Window Layout

The ‘Bookmarks’ window is divided into 4 clear portions:

1. The folders/groups pane
2. The folder note pane
3. The bookmark detail pane
4. The bookmark note pane

The Folders Pane & Folder Note Pane

Bookmarks can be grouped together using folders. These are listed in the Folders Pane (1). When individually selected, the notes for the respective folder, in editable form, can be seen in the ‘Folder Notes’ pane, directly below (2), while the grouped bookmarks can be seen in the ‘Bookmarks’ pane to the right (3).

The Bookmarks Pane & Bookmark Note Pane

Having selected an individual bookmark folder, the contents of the folder will be displayed in the ‘Bookmarks’ pane (3). Each bookmark is listed with: bookmark name, file path, file size and creation date. Columns can of course be resized and sorted by the examiner simply by clicking on the respective header or by dragging the column separators to the desired size. Having selected a bookmark, the notes for the bookmarked item will be displayed, in editable form, in the ‘Bookmark Note’ pane (4).

Resizing Panes

In order to maximize viewing space the examiner can resize the partitions between all four panes of the ‘Bookmarks’ window. To do so, the examiner should click & drag the resize handle of the respective separator, thus being able to minimize and maximize the required viewing space for each pane.

Managing Bookmark Folders

Adding Bookmark Folders

Bookmark folders can be added in one of two ways. The first is to use the ‘Add Bookmark Folder…’ window and the second is to do so from the ‘Bookmarks’ window itself.

Via the ‘Add Bookmark Folder…’ Window

When working with the other functions in MacForensicsLab, it is quickest and easiest to invoke the ‘Add Bookmark Folder…’ window from Bookmarks menu or use the keyboard shortcut: [Command] + [Shift] + [N].

If adding a new folder while creating a new bookmark, then simply click the (+) button below the folder title option list in the ‘Add Bookmark’ window.

Once the ‘Add Bookmark Folder…’ window comes to the fore, the examiner need only enter the name of the new folder (1) into the “Name” text input field, and click Save (3). If the examiner so wishes, he or she can enter a note/summary into the “Summary” text field (2) for reference then and there, or do so at a later date in time from the ‘Bookmarks’ window.

Via the ‘Bookmarks’ Window

The second way to add bookmark folders is to bring the ‘Bookmarks’ window to the fore, after which the examiner must click the (+) button under the ‘Bookmark Folders’ pane. This will generate a new folder with an empty title in the pane above ready with the text cursor in the entry field. Once the name is complete, the examiner can either press Enter/Return or simply click out of the name entry field. To add a summary, having created a new folder in this way, the examiner need only select the new folder in the ‘Bookmark Folders’ pane and then enter his or her summary for the selected folder into the ‘Folder Note’ pane below.

Amending Bookmark Folder Names

Should the examiner wish to amend the name of the bookmark folder, he or she can do so from the ‘Bookmarks’ window by simply double-clicking on the respective bookmark folder’s name in the ‘Bookmark Folders’ pane and make the edits accordingly, before clicking out of the text entry field.

Removing Bookmark Folders

Removing bookmark folders, either collectively or individually, can be done from the ‘Bookmarks’ window.

Clearing ALL Folders

To clear ALL folders and lose the bookmarks contained within them, the examiner must click the (clear) button under the ‘Bookmark Folders’ pane, at which point MacForensicsLab will prompt him or her to confirm the deletion – as it cannot be undone. Having clicked OK, the examiner will be returned to the ‘Bookmarks’ window with a cleared ‘Bookmark Folders’ pane.

Clearing Individual Folders

To remove folders individually, the examiner must select each item in turn and click the (-) button beneath the ‘Bookmark Folders’ pane. As before, there will be a prompt confirming the deletion and the examiner need only click OK to follow through with the the action.

Clearing Actions

Removing Bookmarks

Removing bookmarks, either collectively or individually, can be done from the ‘Bookmarks’ window.

Clearing ALL Bookmarks

To clear ALL bookmarks from within a bookmark folder, the examiner should select the desired bookmark folder in the ‘Bookmark Folders’ pane and then click the (clear) button under the ‘Bookmarks’ pane (1), at which point MacForensicsLab will prompt him or her to confirm the request to delete ALL bookmarks. Having clicked OK, the examiner will be returned to the ‘Bookmarks’ window with a cleared ‘Bookmarks’ pane.

Clearing Individual Bookmarks

To remove bookmarks individually, the examiner must first select the requisite bookmark folder and then, once the bookmarks load, select each item in turn and click the (-) button underneath the ‘Bookmark’ pane (2). As before, there will be a prompt confirming the action and the examiner need only click OK to follow through with the action.

Moving Bookmarks

Starting with version 4.0, the examiner can move bookmarks between folders. For example, to limit the bookmarks to the relevant items, the examiner can create a new bookmark folder, and drag items from another bookmark folder that has thousands of bookmarks gathered from a over general search to the more specific bookmarks, and report only the specific bookmarks during the reporting stage.

To select and move relevant bookmarks to another folder, highlight the bookmark(s) of interest (1) by clicking (or control click to select multiple items), then drag the items into the folder of choice (2).

After the process is completed, the examiner can click on the folder of choice and confirm the bookmarks have been transferred.

Overview

Case Notes are an extremely useful function of MacForensicsLab that allow the examiner to add comments and observations to their case file at any point during the examination process. Whether browsing the ‘Main’ window or in the middle of a lengthy acquisition, the examiner can open the ‘Notes’ tab of the ‘Database’ window, using either the keyboard shortcut ([Command] + [N]) or ‘’Window’ drop menu, and make the desired entry, before returning to the prior screen when finished.

Opening Notes

To access the Notes window at anytime during the investigation, select “Window -> Make Note” from the Main window.

Notes Window Layout

The Notes Window is divided into three sections:

• The Database Tab
• The Note Data Pane
• The Note Information Section

Adding and Removing Case Notes

To add a new note, the examiner need only click the (+) button at the bottom right hand side of the upper ‘Notes Data’ pane. This will generate a blank new entry, which the examiner needs to then select and enter his or her notes into, using the lower ‘Note Entry’ pane. Having completed the note, the examiner can then click the ‘Save’ button and close the ‘Database’ window and return to the previous screen.

Editing Case Notes

When necessary to edit a case note, select the individual note in the ‘Notes’ pane at the top of the window. Once the note itself has loaded in the window below, the examiner is free to edit it at will. Having finished any amendments, click out of the editor pane and the new version of the note will be saved and changes logged.

Removing Case Notes

The examiner can remove individual notes or clear the entire ‘Notes’ pane in one go. To remove an individual note detail the examiner should select the note earmarked for removal and then click the (-) button on the right-hand side below the ‘Notes’ pane. To remove all the details in one go, the examiner should click the (Clear) button on the right-hand side below the ‘Notes’ pane. In both instances, the deletion will generate a warning prompt dialog, to which the examiner must confirm his or her actions.

Refreshing the Notes Pane

When working in a centralized database environment, it is possible that the ‘Notes’ pane may become out of sync with the listing in the database. To bring it up-to-date the examiner needs to click the Refresh button on the left-hand side below the ‘Notes’ pane. The time stamp is in Greenwich time.

Overview

When whichever database (local file or MySQL server) is enabled via the ‘Preferences’ window, detailed logs are kept of every action and all points of interest to support the examiner in the understanding and final presentation of their evidence. In the ‘Database’ window, the examiner has full access to comprehensive details of what has been logged in the forensic examination to date.

Opening the Database

The MacForensicsLab database can be located, from the Main window by selecting “Window -> Database” or using the keyboard shortcut of [Shift] + [Command] + [D].

The Database Window Layout

The ‘Database’ window can essentially be split into 2 parts:
The tab bar – consisting of the various database sections: -Acquisition -Analyze -Audit -Chronology -Hash -Notes -Salvage

The viewing pane(s) – consisting of: -Device information -Date/time/description -Data

Navigating through each individual database tab produces its own unique layout. Each screen’s layout within the ‘Database’ window varies between a single pane with a columnar list and a triple paned layout with bookmarks and note/native viewer.

Viewing the Database Sections

As each tab is clicked in turn the database will be read, either locally or centrally, and the contents loaded into the new window layout; needless to say, the larger the dataset the longer the process of fetching and loading the data will take to complete. Accessible through the individual buttons of the tab bar in the ‘Database’ window are:

The Acquisition Log – lists the date and time of an acquisition process, a description of it and the exact block details (offset, length, hash sum, etc).

The Analyze Log – keeps track of the details of searches performed, as well as the results associated with them. Details logged include: date and time, file location, results and the associated match and offset.

The Audit Log – lists the date and time of an audit process, a description of it and the specific OS artifact information generated, to include folder creation date/times, network preferences, system settings, user preferences, bookmarks, web caches, and much more.

The Chronology Log – lists all the events from the moment the case reference is set up to the latest action performed in MacForensicsLab. It lists the date and time of the actions, the name of the examiner, the action performed (opening windows, pressing buttons etc) and the data returned by the actions.

The Hash Database – provides a means by which the examiner can import, manage and store hash values for use within the various functions provided by MacForensicsLab.

The Notes Log – contains all the notes regarding the investigation as inputted by various examiners. Notes are listed with examiner name, date and initial number of characters, with the ability to view an entire note, as well as manage and edit notes.

The Salvage Log – keeps track of the date and time of the salvage process, the name of the examiner, the actions performed, and the location and specific details of the files salvaged.

Sorting The Data

The examiner can sort by the available columns by clicking on the respective column headers, once highlighted and sorted ascending, clicking the title bar again will sort the column in reverse order.

Managing Records

Certain panes containing log data benefit from the availability of management buttons. That is to say that an assortment of buttons exist to:

• Refresh
• Clear
• Delete
• Add
• Edit

Where available the examiner should use these buttons as in others functions windows to reload data into the respective pane, to remove or clear records, both of which will generate a warning prompt requesting confirmation to delete records, as well as to add items or make amendments.