I had the opportunity to present to a bunch of folks in one of my favorite places, Norway (yes, again!) I wanted to take an initial look into Apple Intelligence (AI), to see what was forensically interesting. I will personally add that I really did enjoy playing with Genmojis and Image Playground (for research purposes of course!). While I didn’t find anything particularly groundbreaking, there…
I’ve uploaded my presentation that I gave at the lovely Sikkerhetsfestivalen 2024 in Lillehammer, Norway. This presentation goes through some pattern-of-life (APOLLO-ish) investigative scenarios.
Hello folks, I’m back! I took a bit of a break because burn out is no joke – seriously…take care of yourselves! I’ve been on what I’m calling a mid-career retirement – travelling the world to make up for lost pandemic travels. I’ve been working on a few projects, most recently (and the purpose for this update) I have updated one of my favorite scripts, FSEventsParser from Nicole Ibrahim. I’ve…
This is the third and final piece of the Mac and iPhone setup process! Sorry for the long delay between the last one and this one, but better late than never right? This guide will help you setup your iDevice with two binaries that can greatly assist with targeted testing and analysis. My goal is to equip you to do your own research and testing to confidently answer the questions you will surely…
I’ve been working hard on a big update to improve core functionality of APOLLO to include methods to gather up the database files needed so they can be extracted from using the APOLLO modules. New APOLLO Functions: ‘gather_macos’ - Automagically finds and collects database files on macOS using modules. Any directory, mounted volume, etc. Ability to ignore certain directories ‘gather_ios’ -…
Collection of Unified Logs on macOS systems is pretty straight forward. You can use the command, and yes – you do have to be root. sudo log collect Collection from iOS device is not as obvious. I think most of us are doing the sysdiagnose/AirDrop method which is tricky. Trying to trigger a sysdiagnose on an iOS device can be frustrating to get the right button hits with the right timing. (Not…
This is a follow-on to the previous post showing how to setup your Mac for iOS testing . If you haven’t read over that one - this article draws assumptions that your Mac is setup in a certain way, or that you know what you’re doing otherwise. Feel free to go read that first, I’ll wait.. Alright, now that we are all on the same page, let’s tackle the second piece and get your iPhone setup for…
CLI…WTF Command line interface (CLI) isn’t for everyone. Trust me; I get it. @iamevltwin forced me out of my comfort zone a few years ago and opened my eyes to the power of Terminal (command prompt on Mac). Now it is pinned to the Dock on every Mac I use, but I still struggle at times and that is okay! The internet provides plenty of support to help me along when I just can’t make something work.…
Facial Recognition in Photos One facet of my DFIR Summit talk I want to expand upon is a look into the Photos application, and a few of the derivative pieces of that endeavor. While trying to focus on the topic of facial recognition, it seemed prudent to include a brief progression from snapping a photo thru to a persons name being placed beside their face in the Photos application. When you use…
The interactionC.db database certainly does not get as much as attention as its CoreDuet partner in crime, knowledgeC.db. However, I think it has quite a bit of investigative potential. I’ve written about it before in a prior blog , however I’d like to give it more attention here. I spent this weekend updating the APOLLO modules to have more contextual support and better backwards compatibility…
While helping some investigators out I realized that my some of my APOLLO knowledgeC modules needed a bit of updating. Naturally I thought it would be quick, but it turned into quite an extensive update. I’ve included lots of brand-new modules as well as updates to ones that I’ve had before. Most of the updates to the older ones provided better backwards compatibility with older versions of macOS…
It’s been a while since I last jailbroke an Apple TV and had a forensic look at it. Using the checkra1n jailbreak , I decided to give it a try. The jailbreak itself was easy and went very smooth. This was using an 4th Gen Apple TV running tvOS 13.4 I wanted to run it through some of my APOLLO modules to see if any needed to be updated. Fortunately, none do as it acts just like iOS! ( whew!) There…
I’ve written about this before in this article but wanted to revisit it for this series. For this scenario I want to test what certain items might look like when they are AirDrop’ed from an unknown source. Many schools have been receiving bomb threats via AirDrop, I want to see if there is a way to discover where they originated from. In my testing you will see artifacts from two iOS devices:…
The DFIR Twitter-sphere exploded this morning when @mattiaep mentioned /private/var/mobile/Library/PersonalizationPortrait/PPSQLDatabase.db. I’ve been doing some research work on this file and plan to present pieces of it during my talk at the upcoming SANS DFIR Summit. I reached out to @iamevltwin and asked if she would host a quick blog post and she graciously agreed - but I now owe her gin, and…
TCC Modifications in the Unified Logs TCC or Transparency, Consent, and Control keeps track of various application permissions. A user can make changes to an application’s permissions in the respective Privacy settings on macOS and iOS. When changing these permissions on macOS entries do get written into the unified logs. While there are many related TCC entries, I want to focus on just permission…
We’ve been trapped inside our homes for months. We’ve reached the end of Netflix, listened to everything on Apple Music, watched old vacation videos trying to remember what travel was like, and mindlessly browsed YouTube videos. All these actions have been recorded in your unified logs! I came across this one while researching another topic and thought it might be useful and a quick write-up.…
A quick trick to get more info when you are testing different Unified log examples is to use Terminal’s man page lookup feature. This is useful to provide more context to processes that you may not be familiar with. Perhaps you have something interesting in the eventMessage field and want to know more about what processes use that information. In this example, I “right-clicked” some of the process…
I’ll walk you through using BlackLight’s APOLLO plugin to track user application usage (knowledgeC, Power Log and Screen Time), device states, network usage and processes, file quarantine, and application permissions (TCC) on macOS. Webinar is available here. Download APOLLO here.
There are many output styles options for the ‘log’ command. Sometimes the default output may not get you what you want. This article will walk through the various log output styles looking for USB Mass Storage Class devices using the keyword ‘USBMSC ‘. These devices may include thumb drives and external hard drives as long as they are considered Mass Storage Class devices . These entries get…
I’m sure many of us are working remote right now possibly using some of these remote capabilities. Remote Logins can include a few different services; SSH and Screen Sharing are two that I’ll show here. These services are disabled by default and would need to be turned on in the user’s Sharing preferences. When Remote Login is turned on in the Sharing preferences, the system will have an SSH…