Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit
This book and companion DVD provide digital forensic investigators, security professionals, and law enforcement with all of the information, tools, and utilities required to conduct forensic investigations of computers running any variant of the Macintosh OS X operating system, as well as the almost ubiquitous iPod and iPhone. Digital forensic investigators and security professionals subsequently can use data gathered from these devices to aid in the prosecution of criminal cases, litigate civil cases, audit adherence to federal regulatory compliance issues, and identify breech of corporate and government usage policies on networks. The companion DVD contains custom tools developed by the authors, which can be used in real-life digital forensic investigations.MAC Disks, Partitioning, and HFS+ File SystemManage multiple partitions on a disk, and understand how the operating system stores data.FileVault and Time MachineDecrypt locked FileVault files and restore files backed up with Leopard's Time Machine.Recovering Browser HistoryUncover traces of Web-surfing activity in Safari with Web cache and .plist filesRecovering Email Artifacts, iChat, and Other Chat LogsExpose communications data in iChat, Address Book, Apple's Mail, MobileMe, and Web-based email.Locating and Recovering PhotosUse iPhoto, Spotlight, and shadow files to find artifacts pof photos (e.g., thumbnails) when the originals no longer exist.Finding and Recovering QuickTime Movies and Other VideoUnderstand video file formats--created with iSight, iMovie, or another application--and how to find them.PDF, Word, and Other Document RecoveryRecover text documents and metadata with Microsoft Office, OpenOffice, Entourage, Adobe PDF, or other formats.Forensic Acquisition and Analysis of an iPodDocumentseizure of an iPod model and analyze the iPod image file and artifacts on a Mac.Forensic Acquisition and Analysis of an iPhoneAcquire a physical image of an iPhone or iPod Touch and safely analyze without jailbreaking.