Infinite Loop —

Macworld.Ars: State of Mac data forensics

As Apple's computers and mobile devices become increasingly popular, they …

Mac-based forensics. Photo (CC) Lucas Mathis.

As we entrust our lives to computers and digital devices like iPhones, we leave a trail of data relating to various activities. When these activities turn nefarious, it's up to law enforcement to follow that data trail and gather evidence for use in court. This process, what Purdue University professor Dr. Marc Rogers calls "cyber forensics," is involving Apple technology more and more as Apple's computers, iPods, and iPhones continue to rise in market share.

During last week's Macworld Expo '09, Blackbag Technology CTO Derrick Donnelly (a former Apple engineer) and SubRosaSoft CEO Marko Kostyrko held a seminar for law enforcement officers, explaining the use of Macs in forensics work. Both CEOs also discussed the benefits of each company's respective software solutions, and Apple technical sales representatives were on hand to answer questions as well.

Three issues surround the use of Macs in forensics. One is getting law enforcement and forensics experts familiar with Mac OS X and its file system. Apple's computers are as popular as they've ever been, selling in record numbers. Both Blackbag and SubRosaSoft offer training and consulting on Mac-based forensics. Since many OS X apps store data in standardized and well-documented ways built in to the system, this actually helps law enforcement separate the wheat from the chaff—in other words, separating important evidence from the billions of bits filling up the average hard drive.

Additionally, the iPhone and iPod touch are selling like hotcakes, and these devices can also be a source of evidence in many cases. Since the iPhone OS used on those devices is based on Mac OS X, techniques learned for Mac OS X can transfer to those devices. Blackbag's Donnelly notes with some irony that the jailbreak scene is actually a boon to investigators, since jailbreak tools can allow greater access to the file system on Apple's portable devices than is possible by default. Well-known iPhone hacker Jonathan Zdziarski has written a highly regarded book on the subject, aptly titled iPhone Forensics. Because the iPhone is often a central repository for information, it can contain images, time-stamped GPS coordinates, SMS messages, emails, contacts, and more. This information can often end up being critical to a criminal investigation.

Write lockers, like Blackbag's FireBox,
are critical to creating tamper-proof
disk images for investigation.

The second issue is necessary software tools. When Ars spoke with him this past summer, Dr. Rogers noted that Mac OS X-based forensics tools were "immature" and that "Mac tools are about where Windows tools were about 10 years ago." Both Blackbag and SubRosaSoft are doing their best to remedy that situation. Blackbag's Macintosh Forensics Suite and SubRosaSoft's MacForensicsLab offer tools for creating read-only, hashed disk images, critical for admitting computer forensics data into evidence. The tools also offer a variety of ways to examine the data, though SubRosaSoft's suite seems to offer more straightforward ways to access and filter data in a more "human-readable way." For instance, its image filtering tool can analyze images for skin tones to find evidence of child pornography.

Both companies also make tools for field investigators to quickly gather data from a users machine. Blackbag's MacQuisition Boot Disk makes an easy task of creating a read-only, hashed disk image. SubRosaSoft's MacLockPick is a fairly advanced tool which can quickly gather data from a Mac, including extracting data stored in iPhone backups, broswer caches, iPhoto library, and the Mac OS X keychain. During a quick demonstration, Kostyrko told Ars that "90 percent of Macs are in the default state—that is, the user is an admin and auto-login is enabled." This makes USB flash drive + software combo a quick tool for field investigators to get a large amount of useful data quickly, especially if time constraints rule out the possibility of making a full image. The hashed, archived data can then be taken to a lab for further analysis.

MacLockPick is an extensible, easy to
use tool for in-field e-discovery.

The last issue is using Macs as a tool to do forensics work. Macs are increasingly becoming the tool of choice among forensics experts in law enforcement. One of the biggest benefits, says Donnelly, is that a MacBook or MacBook Pro can be configured to "triple-boot" into Mac OS X, Windows, and Linux, giving investigators the ability to analyze multiple platforms with just one machine. For doing field work, that means hauling less equipment around. He also noted that MacFUSE enables Mac OS X to mount a number of other file systems as well, so it's possible to just use Mac OS X to image a drive from a non-Mac system and take it back to a lab for further analysis. Kostyrko told the crowd, "You all have taste, so you have a Mac, but that doesn't necessarily mean the suspect does."

If your work could benefit from learning more about Macs and forensics, Apple has produced an informative webinar that features both Donnelly and Kostyrko as well as Detective Mark Honken of L.A. County Sheriff's Department.

You must to comment.