Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit (Book Only)

572 Pages·2008·42.47 MB·English

by  Ryan R. Kubasiak

Visit us at
www.syngress.com
Syngress is committed to publishing high-quality books for IT Professionals and delivering
those books in media and formats that fit the demands of our customers. We are also
committed to extending the utility of the book you purchase via additional materials
available from our Web site.
SOLUTIONS WEB SITE
To register your book, please visit www.syngress.com. Once registered, you can access
your e-book with print, copy, and comment features enabled.
ULTIMATE CDs
Our Ultimate CD product line offers our readers budget-conscious compilations of
some of our best-selling backlist titles in Adobe PDF form. These CDs are the perfect
way to extend your reference library on key topics pertaining to your area of expertise,
including Cisco Engineering, Microsoft Windows System Administration, CyberCrime
Investigation, Open Source Security, and Firewall Configuration, to name a few.
DOWNLOADABLE E-BOOKS
For readers who can’t wait for hard copy, we offer most of our titles in downloadable
e-book format. These are available at www.syngress.com.
SITE LICENSING
Syngress has a well-established program for site licensing our e-books onto servers
in corporations, educational institutions, and large organizations. Please contact our
corporate sales department at [email protected] for more information.
CUSTOM PUBLISHING
Many organizations welcome the ability to combine parts of multiple Syngress books,
as well as their own content, into a single volume for their own internal use. Please
contact our corporate sales department at [email protected] for more
information.
This page intentionally left blank
Jesse Varsalone
Technical Editor
Ryan R. Kubasiak, Sean Morrissey
Lead Authors
Walter Barr
James “Kelly” Brown
Max Caceres
Mike Chasman
James Cornell
Disclaimer::
All equipment photos are provided courtesy of Apple® and are intended for informational purposes only. Their use does
not in any way constitute endorsement, partnering or any other type of involvement on the part of Apple®.
Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively
“Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work.
There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is
sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other
incidental or consequential damages arising out from the Work or its contents. Because some states do not
allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation
may not apply to you.
You should always use reasonable care, including backup and other appropriate precautions, when working
with computers, networks, data, and files.
Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®,” “Ask the Author
UPDATE®,” and “Hack Proofing®,” are registered trademarks of Elsevier, Inc. “Syngress: The Definition
of a Serious Security Library”™, “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think
Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are
trademarks or service marks of their respective companies.
Unique Passcode
32750962
PUBLISHED BY
Syngress Publishing, Inc.
Elsevier, Inc.
30 Corporate Drive
Burlington, MA 01803
Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit
Copyright © 2009 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as
permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed
in any form or by any means, or stored in a database or retrieval system, without the prior written
permission of the publisher, with the exception that the program listings may be entered, stored, and
executed in a computer system, but they may not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN 13: 978-1-59749-297-3
Publisher: Laura Colantoni Page Layout and Art: SPI
Acquisitions Editor: Andrew Williams Copy Editors: Alice Brzovic, Audrey Doyle, Judith H. Eby
Developmental Editor: Matthew Cater Indexer: SPI
Technical Editor: Jesse Varsalone Cover Designer: Michael Kavish
Project Manager: Andre Cuello
For information on rights, translations, and bulk sales, contact Matt Pedersen, Senior Sales Manager,
Corporate Sales, at Syngress Publishing; email [email protected].
Library of Congress Cataloging-in-Publication Data
Application Submitted
Technical Editor
Jesse Varsalone, (CISSP, A+, Linux+, Net+, iNet+, Security+, Server+, CTT+, CIW
Professional, MCT, MCSA, MSCE 2000/2003, MCSA/MCSE Security, MCDBA,
MCSD, CWSP, CWNA, CNA, CCNA, MCDST, Oracle 8i/9i DBA, Certified Ethical
Hacker), has served as the director of the MCSE and Network Security Program at the
Computer Career Institute at Johns Hopkins University. For the 2006 academic year, he
served as an assistant professor of computer information systems at Villa Julie College in
Baltimore, MD. He taught courses in networking, Active Directory, Exchange, Cisco, and
forensics.
Jesse holds a bachelor’s degree from George Mason University and a master’s
degree from the University of South Florida. Jesse was a contributing author for
Syngress’s The Official CHFI™ Exam 312-49 Study Guide: For Computer Hacking
Forensics Investigators, ISBN 978-1-59749-197-6, Penetration Tester’s Open Source Toolkit,
Volume 2, ISBN 978-1-59749-213-3 and Technical Editor for Microsoft Forefront
Security Administration Guide, ISBN 978-1-59749-244-7. He runs several Web sites,
including www.mcsecoach.com, which is dedicated to helping people obtain their
MCSE certifications. He currently lives in Columbia, MD with his wife, Kim, and
son, Mason.
v
Lead Authors
Ryan R. Kubasiak, (Apple Certified Support Professional, Certified Computer
Examiner, Encase Certified Examiner, Certified Electronic Evidence Collection
Specialist, Bachelor of Science in Computer Science), has 10 years of experience in
law enforcement and is currently assigned as an investigator in the New York State
Police Computer Crime Unit. Ryan specializes in digital examinations as well as
network intrusion investigation with his extensive network training through law
enforcement and corporate training. He has worked professionally for the State
University of New York at Buffalo as a Local Area Network Administrator supporting
multi-platform environments including Macintosh, Microsoft and Novell server
and desktop operating systems. Ryan is the webmaster for the successful Macintosh
forensic website www.macosxforensics.com. In his spare time, Ryan dedicates
himself to his family, Michelle, Lucas, Makayla and Marisa.
Sean Morrissey, is presently employed by a U.S. Corporation as a Senior Computer
Forensic Professional and is assigned to a contract to provide computer forensic training
in nine subject areas, including Macintosh forensics, Windows forensics, and data
recovery. Mr. Morrissey received a Bachelors Degree from Creighton University.
Mr. Morrissey was a Commissioned Officer in the United States Army, a Law
Enforcement Officer in Maryland, and a Trainer for the U.S. Department of State.
Mr. Morrissey’s experience with Macs dates back to 1984. Mr. Morrissey has also
supported companies such as Dell and Hewlett Packard.
Mr. Morrissey would like to thank Dawn Morrissey, whose patience and
understanding throughout this process made his contributions possible. Mr. Morrissey
would also like to thank Jesse Varsalone for making this book possible and for
bringing him into this project.
Mr. Morrissey currently resides on the Eastern Shore of Maryland, and has one
son that is presently serving his country in the United States Army.
vi
Contributing Authors
Walter “Wally” Barr, (A+, Network+, MCSE, CTT+), has been involved
with computers for nearly twenty years. He has served in various roles
including technical support, hardware and software design, Web programming,
desktop publishing, graphic design, video and music production, database
administration, network administration, and technical training for both the
public and private sectors. He has served in the military as an MP and later
worked for a computer hardware manufacturer, a Dot.com company, and
a contracting firm doing database administration for FEMA.
James “Kelly” Brown, (MCSE, CTT+), is a Senior Computer Forensic
Professional with over nine years of experience in the Information
Technology field. Mr. Brown is an Instructor and Curriculum Developer
at the Department of Defense Cyber Crime Center and holds a Bachelor’s
Degree in Computer Science from Strayer University. Prior to teaching at
the Defense Cyber Investigations Training Academy, Mr. Brown worked
for IBM as an Information Security Professional in the Security, Privacy,
and Wireless Division Federal Sector. While at IBM his duties included
conducting network and database audits, reporting information assurance
and compliance activities, and conducting annual security awareness
training. Mr. Brown has extensive field experience as a Senior Systems
Engineer responsible for the successful development, implementation, and
administration of numerous companies’ networks in the private sector.
Max Caceres is director of research and development for Matasano
Security, an independent security firm specializing in providing software
and services to help organizations and vendors improve their security
postures. Max has over 14 years of product development and security
research experience, and is one of the security industry’s leading experts
on penetration testing. Before joining Matasano, Max led the team
responsible for creating the first automated penetration testing product
vii
CORE IMPACT and co-invented several now-patented technologies
including system call proxying and exploit automation.
Max lives in New York City and enjoys spending time with his wife
Gabriela and jumping out of airplanes.
Mike Chasman, (MCSE, MCSA Messaging, Security+, Server+, Network+,
A+), is Vice President of Sparq Technology Consulting, an information
technology consulting company for small to mid-sized businesses head-
quartered in Baltimore, MD. His specialties include network security,
interoperability in mixed environments such as Apple Mac OS X in
Microsoft domains, and network reconnaissance and troubleshooting.
Mike has been a consultant in the field for more than 5 years, supporting
companies such as Black and Decker, IBM, and Lockheed Martin. Mike
currently resides in Baltimore with his lovely wife, Sera Clara, and three
beautiful (and smart) daughters Reena, Abigail, and Sheera.
I would like to thank Sera, my wife, who made my contribution
possible (somebody had to watch the kids). I would also like to thank
my good friend Jesse for all his hard work in making this book possible.
Thanks Jesse.
James “Jim” Cornell is a noted subject matter expert in the fields of
Computer Science and Forensics. He started working with Macintosh
computers in 1984 and is an Apple Developer. He is currently a government
contractor in the National Capital Region, and has consulted on projects
with most governmental agencies in the area. His numerous certifications
include Certified Forensic Computer Examiner (CFCE), Certified
Information Systems Security Professional (CISSP), Certified Technical
Trainer (CTT+) and he has been a Licensed Peace Officer since 1981.
Jim was a contributing author to Syngress’s OS X Exploits and Defense,
ISBN 978-1-59749-254-6.
Jim would like to send thanks to Tammy for, once again, being there
and understanding the creative process. His love to Katy, Danny, Jewell,
Hunter and Colin who give me hope for our future. And deep thanks to
Henry Vasquez for being a great role model and for saving my life once
or twice.
viii
Contents
About the Mac OS X, iPod, and iPhone
Forensic Analysis DVD Toolkit DVD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix
Chapter 1 Tiger and Leopard Mac OS X Operating Systems . . . . . . . . . . . . . 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
First Responders and Specialized Examiners . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Digital Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Techniques for Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Live Macintosh Examination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Single User Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Boot CD/DVD Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Target Disk Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Macintosh History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Macintosh Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Is It a Mac? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
File System Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Data Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Macintosh Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
The Desktop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Back to My Mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Guest Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Time Machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
FileVault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
UNIX and the FreeBSD System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
BootCamp, Microsoft Windows on a Mac? . . . . . . . . . . . . . . . . . . . . . . . . . 22
Target Disk Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Disk Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Apple Partition Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
GUID Partition Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
ix