content update, macOS methods
This commit is contained in:
overcuriousity
parent
987f737122
commit
0f780e3ce2
249004
data/embeddings.json
249004
data/embeddings.json
File diff suppressed because it is too large
Load Diff
@ -4879,6 +4879,779 @@ tools:
|
|||||||
- malware-hiding
|
- malware-hiding
|
||||||
- system-internals
|
- system-internals
|
||||||
knowledgebase: true
|
knowledgebase: true
|
||||||
|
- name: hdiutil
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
macOS-nativer Disk-Image-Manager erstellt und mountet DMG, ISO, IMG-Dateien für forensische Analyse. Besonders wertvoll: Sparse-Image-Creation für Live-Collection, Checksum-Verifizierung mit CRC32/MD5, Read-Only-Mounting verhindert Beweis-Kontamination. Komprimierung und Verschlüsselung für sichere Evidence-Storage. Integration in Automator-Workflows für Batch-Processing. Der Standard für macOS-Imaging ohne externe Tools.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://ss64.com/osx/hdiutil.html
|
||||||
|
icon: 💿
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- data-collection
|
||||||
|
- examination
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
accessType: built-in
|
||||||
|
license: Proprietary
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- disk-imaging
|
||||||
|
- mounting
|
||||||
|
- apfs
|
||||||
|
- compression
|
||||||
|
- encryption
|
||||||
|
- checksum
|
||||||
|
- sparse-images
|
||||||
|
related_concepts:
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- dd
|
||||||
|
- Fuji
|
||||||
|
|
||||||
|
- name: asr
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Apple Software Restore führt Block-Level-Restores von macOS-Images durch und ermöglicht forensisches Cloning ganzer Volumes. Besonders bei APFS-Container-Forensik wertvoll: Bit-genaue Duplikation inklusive Metadaten, Snapshot-Preservation und FileVault-Verschlüsselung. Network-Restore-Fähigkeiten für Remote-Imaging. Der Low-Level-Zugriff umgeht Dateisystem-Beschränkungen für saubere Akquisition.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: https://ss64.com/osx/asr.html
|
||||||
|
icon: 🔄
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- data-collection
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
accessType: built-in
|
||||||
|
license: Proprietary
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- disk-imaging
|
||||||
|
- cloning
|
||||||
|
- apfs
|
||||||
|
- filevault
|
||||||
|
- network-restore
|
||||||
|
- block-level
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- hdiutil
|
||||||
|
- dd
|
||||||
|
|
||||||
|
- name: plutil
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Property-List-Parser konvertiert zwischen XML, Binary und JSON-Formaten für macOS-Artefakt-Analyse. Extrahiert Konfigurationsdaten aus Apps, System-Preferences und versteckten Plist-Files. Besonders wertvoll: Binary-Plist-Dekodierung ohne Xcode, Syntax-Validation für korrupte Files, Batch-Conversion für Massen-Analyse. Command-Line-Integration in Forensik-Scripts. Unverzichtbar für macOS-Application-Forensik.
|
||||||
|
skillLevel: beginner
|
||||||
|
url: https://ss64.com/osx/plutil.html
|
||||||
|
icon: 📋
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
accessType: built-in
|
||||||
|
license: Proprietary
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- plist-parser
|
||||||
|
- xml-conversion
|
||||||
|
- json-export
|
||||||
|
- artifact-extraction
|
||||||
|
- batch-processing
|
||||||
|
- macos-artifacts
|
||||||
|
related_concepts:
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software:
|
||||||
|
- ExifTool
|
||||||
|
|
||||||
|
- name: spotlight_parser
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Python-Framework analysiert macOS-Spotlight-Index für versteckte Dateimetadaten und Suchhistorie. Extrahiert gelöschte Referenzen, Volltext-Indizes und User-Search-Patterns aus .store-Datenbanken. Rekonstruiert File-Timeline auch nach Löschung, identifiziert externe Volume-Verbindungen. Besonders wertvoll für User-Activity-Tracking und Data-Exfiltration-Nachweis auf macOS-Systemen.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://github.com/ydkhatri/spotlight_parser
|
||||||
|
icon: 🔍
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
- Linux
|
||||||
|
- Windows
|
||||||
|
accessType: download
|
||||||
|
license: MIT
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- spotlight-analysis
|
||||||
|
- metadata-parser
|
||||||
|
- deleted-file-recovery
|
||||||
|
- search-history
|
||||||
|
- python-tool
|
||||||
|
- macos-artifacts
|
||||||
|
- user-activity
|
||||||
|
related_concepts:
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software:
|
||||||
|
- ALEAPP
|
||||||
|
- iLEAPP
|
||||||
|
|
||||||
|
- name: FSEventsParser
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Dekodiert macOS-FSEvents-Logs für vollständige Dateisystem-Aktivitäts-Timeline ohne Lücken. Trackt Datei-Creation, Modification, Deletion und Movement auch bei gelöschten Files. Besonders wertvoll: Millisecond-Precision-Timestamps, Volume-übergreifende Tracking, Correlation mit anderen Artefakten. Python-basierte Parsing-Engine für Command-Line-Integration. Standard-Tool für macOS-Timeline-Forensik und Incident-Reconstruction.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://github.com/dlcowen/FSEventsParser
|
||||||
|
icon: 📊
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
- Linux
|
||||||
|
- Windows
|
||||||
|
accessType: download
|
||||||
|
license: GPL-3.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- timeline-analysis
|
||||||
|
- filesystem-monitoring
|
||||||
|
- python-tool
|
||||||
|
- macos-artifacts
|
||||||
|
- deleted-file-recovery
|
||||||
|
- high-precision
|
||||||
|
- correlation-engine
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software:
|
||||||
|
- Plaso (log2timeline)
|
||||||
|
- Timesketch
|
||||||
|
|
||||||
|
- name: chainbreaker
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Python-Tool extrahiert Passwörter, Zertifikate und Schlüssel aus macOS-Keychain-Dateien für Credential-Recovery. Dekryptiert sowohl Login- als auch System-Keychains mit User-Passwort oder Master-Key. Besonders wertvoll: WiFi-Passwort-Extraktion, Certificate-Chain-Analysis, Secure-Notes-Dekodierung. Batch-Processing für Enterprise-Deployments. Export in strukturierte Formate für weitere Analyse. Standard für macOS-Credential-Forensik.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: https://github.com/n0fate/chainbreaker
|
||||||
|
icon: ⛓️
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
- Linux
|
||||||
|
- Windows
|
||||||
|
accessType: download
|
||||||
|
license: GPL-3.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- credential-extraction
|
||||||
|
- keychain-analysis
|
||||||
|
- password-recovery
|
||||||
|
- certificate-analysis
|
||||||
|
- python-tool
|
||||||
|
- macos-artifacts
|
||||||
|
- wifi-passwords
|
||||||
|
related_concepts:
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
related_software:
|
||||||
|
- hashcat
|
||||||
|
|
||||||
|
- name: UnifiedLogReader
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Alpha-Stadium-Parser für macOS-Unified-Logging-System analysiert strukturierte Logd-Datenbanken für System-Event-Reconstruction. Extrahiert versteckte Debug-Messages, Kernel-Events und App-Crashes aus tracev3-Files. Besonders wertvoll bei Malware-Persistenz-Analysis und System-Tampering-Detection. Korreliert Events über Process-Boundaries hinweg. Experimentelle Software mit begrenzter Stability aber einzigartige Capabilities.
|
||||||
|
skillLevel: expert
|
||||||
|
url: https://github.com/ydkhatri/UnifiedLogReader
|
||||||
|
icon: 📜
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- malware-analysis
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
- Linux
|
||||||
|
- Windows
|
||||||
|
accessType: download
|
||||||
|
license: MIT
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- log-parser
|
||||||
|
- unified-logs
|
||||||
|
- python-tool
|
||||||
|
- macos-artifacts
|
||||||
|
- system-events
|
||||||
|
- kernel-analysis
|
||||||
|
- experimental
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
related_software:
|
||||||
|
- Plaso (log2timeline)
|
||||||
|
- Aftermath
|
||||||
|
|
||||||
|
- name: xmount
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Virtuelles Dateisystem mountet forensische Images als Block-Devices für Live-Analyse ohne Extraktion. Unterstützt EWF, AFF, RAW und DMG-Formate mit gleichzeitiger Konvertierung zwischen Formaten. Besonders wertvoll: Cache-System beschleunigt wiederholte Zugriffe, Write-Cache simuliert beschreibbare Images für Tests. FUSE-basierte Architektur für Linux/macOS-Integration. Perfekt für Timeline-Tools die direkten Disk-Zugriff benötigen.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://www.pinguin.lu/xmount
|
||||||
|
icon: 🗄️
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
accessType: download
|
||||||
|
license: GPL-3.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- virtual-filesystem
|
||||||
|
- image-mounting
|
||||||
|
- format-conversion
|
||||||
|
- fuse-based
|
||||||
|
- cache-system
|
||||||
|
- write-simulation
|
||||||
|
- cross-format
|
||||||
|
related_concepts:
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software:
|
||||||
|
- OSFMount
|
||||||
|
- ewfmount
|
||||||
|
|
||||||
|
- name: ewfmount
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
FUSE-Wrapper mountet Expert-Witness-Format-Images als reguläre Files für Standard-Tool-Zugriff. Teil der libewf-Suite ermöglicht Read-Only-Access auf E01/Ex01-Segmente ohne Vollextraktion. Besonders praktisch: Integration in Standard-Workflows, Performance-Optimierung für große Archives, Metadata-Preservation. Cross-Platform-Verfügbarkeit für heterogene Lab-Umgebungen. Alternative zu proprietären Mounting-Tools.
|
||||||
|
skillLevel: beginner
|
||||||
|
url: https://github.com/libyal/libewf/wiki/Mounting
|
||||||
|
icon: 📁
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
platforms:
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
accessType: download
|
||||||
|
license: LGPL-3.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- ewf-mounting
|
||||||
|
- fuse-filesystem
|
||||||
|
- read-only
|
||||||
|
- segment-handling
|
||||||
|
- cross-platform
|
||||||
|
- libewf-suite
|
||||||
|
- performance-optimized
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- xmount
|
||||||
|
- ewfacquire
|
||||||
|
|
||||||
|
- name: iPhone Backup Extractor
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Kommerzielle iOS-Backup-Analysis-Suite extrahiert Daten aus iTunes/Finder-Backups inklusive verschlüsselter Archives. Dekodiert App-Sandboxes, Keychain-Items und gelöschte SQLite-Records für umfassende iOS-Forensik. Besonders wertvoll: GUI für nicht-technische Ermittler, automatische App-Erkennung, Timeline-Export. Unterstützt iOS 3-17 mit regelmäßigen Updates. Premium-Features für Location-Data und Advanced-Recovery.
|
||||||
|
skillLevel: beginner
|
||||||
|
url: https://www.3utools.com/iphone-backup-extractor/
|
||||||
|
icon: 📱
|
||||||
|
domains:
|
||||||
|
- mobile-forensics
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Windows
|
||||||
|
- macOS
|
||||||
|
accessType: commercial
|
||||||
|
license: Proprietary
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- gui
|
||||||
|
- ios-backup
|
||||||
|
- commercial
|
||||||
|
- keychain-extraction
|
||||||
|
- app-analysis
|
||||||
|
- timeline-export
|
||||||
|
- encrypted-backup
|
||||||
|
- sqlite-recovery
|
||||||
|
related_concepts:
|
||||||
|
- SQL
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
related_software:
|
||||||
|
- iLEAPP
|
||||||
|
- Cellebrite UFED
|
||||||
|
|
||||||
|
- name: tmutil
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Time-Machine-Utility steuert macOS-Backup-System und analysiert Snapshot-Strukturen für forensische Timeline-Reconstruction. Listet verfügbare Backups, vergleicht Versionen und extrahiert historische File-States. Besonders wertvoll: Point-in-Time-Recovery für Evidence, Metadata-Analyse von Backup-Changes, APFS-Snapshot-Integration. Thin-Backup-Analysis reduziert Storage-Overhead. Command-Line-Access für Scripting-Integration.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://ss64.com/osx/tmutil.html
|
||||||
|
icon: ⏰
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- macOS
|
||||||
|
accessType: built-in
|
||||||
|
license: Proprietary
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- cli
|
||||||
|
- backup-analysis
|
||||||
|
- snapshot-examination
|
||||||
|
- apfs-snapshots
|
||||||
|
- version-comparison
|
||||||
|
- timeline-reconstruction
|
||||||
|
- point-in-time-recovery
|
||||||
|
- metadata-analysis
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software:
|
||||||
|
- ShadowExplorer
|
||||||
|
- hdiutil
|
||||||
|
- name: macOS Target Disk Mode Acquisition
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Forensische Datensammlung über Target Disk Mode (TDM) durch Drücken der T-Taste beim Boot-Vorgang.
|
||||||
|
Das Asservat verhält sich wie eine externe Festplatte über Firewire/Thunderbolt-Verbindung.
|
||||||
|
Vollständiges Verfahren: 1) Hardware-Schreibblocker anschließen, 2) T-Taste beim Boot drücken,
|
||||||
|
3) Ziel-Mac per Firewire/Thunderbolt verbinden, 4) Imaging mit dd/hdiutil durchführen.
|
||||||
|
Limitierungen: nur erste Festplatte verfügbar, Firmware-Passwort blockiert TDM,
|
||||||
|
Benutzerpasswort für FileVault-Entschlüsselung erforderlich.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 🎯
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- data-collection
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- live-acquisition
|
||||||
|
- target-disk-mode
|
||||||
|
- hardware-connection
|
||||||
|
- write-blocker-required
|
||||||
|
- firmware-limitation
|
||||||
|
- password-dependent
|
||||||
|
- scenario:disk_imaging
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- dd
|
||||||
|
|
||||||
|
- name: macOS Auto-Mount Prevention
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Verhinderung automatischen Mountens durch temporäres Deaktivieren des Disk Arbitrators.
|
||||||
|
Verfahren: 1) 'sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist' ausführen,
|
||||||
|
2) Datenträger anschließen (kein diskutil verfügbar), 3) Imaging durchführen,
|
||||||
|
4) 'sudo launchctl load /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist' zur Reaktivierung.
|
||||||
|
Alternative zu Hardware-Schreibblockern für forensisch saubere Anbindung.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 🚫
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- data-collection
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- write-blocker
|
||||||
|
- disk-arbitrator
|
||||||
|
- system-modification
|
||||||
|
- contamination-prevention
|
||||||
|
- sudo-required
|
||||||
|
- manual-mounting
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS Property List Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Systematische Auswertung von Apple Property List Dateien (Plist) in XML- und
|
||||||
|
Binärformat für Konfigurationsdaten und Systemeinstellungen. Konvertierung zwischen
|
||||||
|
Formaten mit plutil-Tool, strukturierte Analyse des binären Objektaufbaus mit 8-Byte-Header,
|
||||||
|
variabler Objekttabelle, Offset-Tabelle und 32-Byte-Trailer. Extraktion forensischer
|
||||||
|
Artefakte aus Systemkonfigurationen, Anwendungseinstellungen und Benutzeraktivitäten.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 📋
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
- mobile-forensics
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- plist-analysis
|
||||||
|
- binary-decode
|
||||||
|
- configuration-parsing
|
||||||
|
- system-metadata
|
||||||
|
- artifact-extraction
|
||||||
|
- format-conversion
|
||||||
|
- xml-parsing
|
||||||
|
related_concepts: []
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS Spotlight Forensic Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Tiefgehende Auswertung der Spotlight-Indexdatenbanken (.store-Dateien) für umfassende
|
||||||
|
Dateimetadaten und Aktivitätsnachweise. Extraktion von Öffnungshäufigkeiten, letzten
|
||||||
|
Zugriffsdaten und versteckten Metadaten die im normalen Dateisystem nicht verfügbar sind.
|
||||||
|
Fundorte: /.Spotlight-V100/Store-V2/<UUID>/.store und ~/Library/Metadata/CoreSpotlight/.
|
||||||
|
Analyse erfordert spezielle Python-Parser für proprietäres undokumentiertes Format.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: ""
|
||||||
|
icon: 🔍
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- spotlight-analysis
|
||||||
|
- metadata-extraction
|
||||||
|
- timeline-analysis
|
||||||
|
- file-activity
|
||||||
|
- indexing-forensics
|
||||||
|
- database-parsing
|
||||||
|
- python-tools
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS FSEvents Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Forensische Auswertung von FSEvents-Logs für historische Dateisystemänderungen seit macOS 10.7.
|
||||||
|
Fundort: /.fseventsd/xxxxxxxxxx (gzip-komprimiert). Dateiname entspricht letzter Event-ID + 1.
|
||||||
|
Dekomprimierung und Parsing für chronologische Rekonstruktion von Datei-/Ordner-Operationen.
|
||||||
|
Besonderheit: alphabetische statt chronologische Speicherung erfordert spezielle Parser
|
||||||
|
für zeitbasierte Analyse und Aktivitätsmuster-Erkennung.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 📁
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- fsevents-analysis
|
||||||
|
- filesystem-monitoring
|
||||||
|
- historical-analysis
|
||||||
|
- gzip-decompression
|
||||||
|
- timeline-reconstruction
|
||||||
|
- file-operations
|
||||||
|
- activity-tracking
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS Keychain Forensic Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Extraktion und Entschlüsselung von Passwörtern aus macOS Keychain-Dateien
|
||||||
|
(~/Library/Keychains/*) für Zugangsdaten-Recovery. Auf T2/M1-Systemen Hardware-Bindung
|
||||||
|
durch HEK-Schlüssel, Entschlüsselung nur mit bekanntem Benutzerpasswort möglich.
|
||||||
|
Neuere Versionen: Export-Funktion deaktiviert, Alternative über Safari-Password-Manager
|
||||||
|
(CSV-Export) oder Python-Chainbreaker-Tools für Offline-Analyse.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: ""
|
||||||
|
icon: 🔐
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
- fraud-investigation
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- keychain-analysis
|
||||||
|
- password-extraction
|
||||||
|
- hardware-encryption
|
||||||
|
- credential-recovery
|
||||||
|
- t2-m1-limitations
|
||||||
|
- python-tools
|
||||||
|
- access-restriction
|
||||||
|
related_concepts:
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS Unified Log Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Dekodierung und Analyse des Apple Unified Logging (AUL) ab macOS 10.12 für
|
||||||
|
systemweite Event-Korrelation. Datenquellen: /var/db/diagnostics/Persist/ (tracev3-Dateien),
|
||||||
|
/var/db/diagnostics/Special/ und /var/db/uuidtext. Analyse mit 'log show', 'log collect',
|
||||||
|
Predicate-Filter für gezielte Suchen. Offline-Analyse erfordert Übertragung der
|
||||||
|
Verzeichnisse auf Analyse-Mac oder Virtualisierung des Zielsystems.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: ""
|
||||||
|
icon: 📊
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- unified-logging
|
||||||
|
- tracev3-parsing
|
||||||
|
- predicate-filters
|
||||||
|
- subsystem-analysis
|
||||||
|
- binary-log-format
|
||||||
|
- timeline-creation
|
||||||
|
- system-monitoring
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS DMG Image Mounting
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Forensisch sauberes Mounting von Mac Disk Images mit Write-Protection. Verfahren:
|
||||||
|
1) DMG-Datei als 'geschützt' markieren (Schloss-Icon), 2) 'hdiutil attach -shadow'
|
||||||
|
für Shadow-File-Erstellung, 3) 'mdutil -i on' für Spotlight-Indexierung ohne Original-Änderung.
|
||||||
|
Alternative: RAW/E01-Images mit xmount zu DMG konvertieren. Ermöglicht native macOS-Tool-Nutzung
|
||||||
|
und Spotlight-Durchsuchbarkeit bei forensischer Integrität.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 💿
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- dmg-mounting
|
||||||
|
- write-protection
|
||||||
|
- shadow-files
|
||||||
|
- spotlight-indexing
|
||||||
|
- image-conversion
|
||||||
|
- forensic-imaging
|
||||||
|
- read-only-access
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- OSFMount
|
||||||
|
|
||||||
|
- name: macOS Time Machine Backup Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Forensische Auswertung von Time Machine Backups für historische Systemzustände.
|
||||||
|
Bis macOS 10.x: HFS+-Sparse-Bundle mit Hardlinks, ab BigSur: APFS-Snapshots.
|
||||||
|
Analyse-Befehle: 'tmutil listbackups', 'tmutil listlocalsnapshots', 'tmutil destinationinfo'.
|
||||||
|
Backup-Struktur: stündlich (24h), täglich (1 Monat), wöchentlich (permanent).
|
||||||
|
Auswertung der backup_manifest.plist für Snapshot-IDs und Timeline-Rekonstruktion.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: ⏰
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- time-machine-analysis
|
||||||
|
- backup-forensics
|
||||||
|
- sparse-bundle
|
||||||
|
- apfs-snapshots
|
||||||
|
- hardlink-analysis
|
||||||
|
- historical-recovery
|
||||||
|
- manifest-parsing
|
||||||
|
related_concepts:
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
- File Systems & Storage Forensics
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: iOS Backup Forensic Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Extraktion und Analyse von iTunes/iCloud-Backups für iOS-Geräte-Forensik.
|
||||||
|
Fundorte: Windows: /Users/[User]/AppData/Roaming/Apple Computer/MobileSync/Backup/,
|
||||||
|
macOS: ~/Library/Application Support/MobileSync/Backup/. UDID-basierte Ordnerstruktur
|
||||||
|
(SHA1 aus Seriennummer/IMEI/MAC), GUID-benannte Dateien enthalten iOS-Dateisystem-Inhalte.
|
||||||
|
Analyse von Info.plist, Manifest.plist, Status.plist für Backup-Metadaten.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 📱
|
||||||
|
domains:
|
||||||
|
- mobile-forensics
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- ios-backup-analysis
|
||||||
|
- udid-decoding
|
||||||
|
- manifest-parsing
|
||||||
|
- app-data-recovery
|
||||||
|
- backup-decryption
|
||||||
|
- mobile-artifacts
|
||||||
|
- itunes-backup
|
||||||
|
related_concepts:
|
||||||
|
- SQL
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
related_software:
|
||||||
|
- Cellebrite UFED
|
||||||
|
|
||||||
|
- name: macOS iCloud Artifact Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Systematische Auswertung von iCloud-Synchronisations-Artefakten im lokalen Dateisystem.
|
||||||
|
Fundorte: ~/Library/Application Support/iCloud/Accounts (iCloud-ID),
|
||||||
|
~/Library/Mobile Documents/ (synchronisierte Dateien), ~/Library/SyncedPreferences/ (App-Einstellungen),
|
||||||
|
~/Library/Application Support/CloudDocs/ (client.db/server.db). Extraktion der account.1-Datei
|
||||||
|
und .DS_Store-Analyse für Cloud-Aktivitätsnachweise ohne direkten iCloud-Zugriff.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: ""
|
||||||
|
icon: ☁️
|
||||||
|
domains:
|
||||||
|
- cloud-forensics
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- icloud-forensics
|
||||||
|
- cloud-synchronization
|
||||||
|
- mobile-documents
|
||||||
|
- token-extraction
|
||||||
|
- sync-analysis
|
||||||
|
- cloud-artifacts
|
||||||
|
- metadata-analysis
|
||||||
|
related_concepts:
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
related_software: []
|
||||||
|
|
||||||
|
- name: macOS Communication App Analysis
|
||||||
|
type: method
|
||||||
|
description: >-
|
||||||
|
Forensische Untersuchung nativer macOS Kommunikations-Apps für Nachrichtenverlauf.
|
||||||
|
Messages: chat.db-SQLite-Datenbank (Tabellen: chat, messages, handle, attachments),
|
||||||
|
Attachments-Verzeichnis. Mail: Envelope Index-Datenbank, .emlx-Dateien, Accounts-SQLite.
|
||||||
|
Kontakte: AddressBook-v22.abcddb, MailRecents-v4.abcdmr. FaceTime: Plist-Konfigurationen
|
||||||
|
mit Anruflisten. Korrelation zwischen Apps und iOS-Synchronisation.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: ""
|
||||||
|
icon: 💬
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- fraud-investigation
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms: []
|
||||||
|
accessType: null
|
||||||
|
license: null
|
||||||
|
knowledgebase: true
|
||||||
|
tags:
|
||||||
|
- communication-analysis
|
||||||
|
- chat-db-analysis
|
||||||
|
- message-recovery
|
||||||
|
- attachment-extraction
|
||||||
|
- contact-analysis
|
||||||
|
- ios-synchronization
|
||||||
|
- sqlite-parsing
|
||||||
|
related_concepts:
|
||||||
|
- SQL
|
||||||
|
- Timeline Analysis & Event Correlation
|
||||||
|
related_software: []
|
||||||
domains:
|
domains:
|
||||||
- id: incident-response
|
- id: incident-response
|
||||||
name: Incident Response & Breach-Untersuchung
|
name: Incident Response & Breach-Untersuchung
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user