content update, macOS methods
This commit is contained in:
overcuriousity
parent
987f737122
commit
0f780e3ce2
249004
data/embeddings.json
249004
data/embeddings.json
File diff suppressed because it is too large
Load Diff
@ -4879,6 +4879,779 @@ tools:
|
||||
- malware-hiding
|
||||
- system-internals
|
||||
knowledgebase: true
|
||||
- name: hdiutil
|
||||
type: software
|
||||
description: >-
|
||||
macOS-nativer Disk-Image-Manager erstellt und mountet DMG, ISO, IMG-Dateien für forensische Analyse. Besonders wertvoll: Sparse-Image-Creation für Live-Collection, Checksum-Verifizierung mit CRC32/MD5, Read-Only-Mounting verhindert Beweis-Kontamination. Komprimierung und Verschlüsselung für sichere Evidence-Storage. Integration in Automator-Workflows für Batch-Processing. Der Standard für macOS-Imaging ohne externe Tools.
|
||||
skillLevel: intermediate
|
||||
url: https://ss64.com/osx/hdiutil.html
|
||||
icon: 💿
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
platforms:
|
||||
- macOS
|
||||
accessType: built-in
|
||||
license: Proprietary
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- disk-imaging
|
||||
- mounting
|
||||
- apfs
|
||||
- compression
|
||||
- encryption
|
||||
- checksum
|
||||
- sparse-images
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- dd
|
||||
- Fuji
|
||||
|
||||
- name: asr
|
||||
type: software
|
||||
description: >-
|
||||
Apple Software Restore führt Block-Level-Restores von macOS-Images durch und ermöglicht forensisches Cloning ganzer Volumes. Besonders bei APFS-Container-Forensik wertvoll: Bit-genaue Duplikation inklusive Metadaten, Snapshot-Preservation und FileVault-Verschlüsselung. Network-Restore-Fähigkeiten für Remote-Imaging. Der Low-Level-Zugriff umgeht Dateisystem-Beschränkungen für saubere Akquisition.
|
||||
skillLevel: advanced
|
||||
url: https://ss64.com/osx/asr.html
|
||||
icon: 🔄
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- data-collection
|
||||
platforms:
|
||||
- macOS
|
||||
accessType: built-in
|
||||
license: Proprietary
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- disk-imaging
|
||||
- cloning
|
||||
- apfs
|
||||
- filevault
|
||||
- network-restore
|
||||
- block-level
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- hdiutil
|
||||
- dd
|
||||
|
||||
- name: plutil
|
||||
type: software
|
||||
description: >-
|
||||
Property-List-Parser konvertiert zwischen XML, Binary und JSON-Formaten für macOS-Artefakt-Analyse. Extrahiert Konfigurationsdaten aus Apps, System-Preferences und versteckten Plist-Files. Besonders wertvoll: Binary-Plist-Dekodierung ohne Xcode, Syntax-Validation für korrupte Files, Batch-Conversion für Massen-Analyse. Command-Line-Integration in Forensik-Scripts. Unverzichtbar für macOS-Application-Forensik.
|
||||
skillLevel: beginner
|
||||
url: https://ss64.com/osx/plutil.html
|
||||
icon: 📋
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
accessType: built-in
|
||||
license: Proprietary
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- plist-parser
|
||||
- xml-conversion
|
||||
- json-export
|
||||
- artifact-extraction
|
||||
- batch-processing
|
||||
- macos-artifacts
|
||||
related_concepts:
|
||||
- File Systems & Storage Forensics
|
||||
related_software:
|
||||
- ExifTool
|
||||
|
||||
- name: spotlight_parser
|
||||
type: software
|
||||
description: >-
|
||||
Python-Framework analysiert macOS-Spotlight-Index für versteckte Dateimetadaten und Suchhistorie. Extrahiert gelöschte Referenzen, Volltext-Indizes und User-Search-Patterns aus .store-Datenbanken. Rekonstruiert File-Timeline auch nach Löschung, identifiziert externe Volume-Verbindungen. Besonders wertvoll für User-Activity-Tracking und Data-Exfiltration-Nachweis auf macOS-Systemen.
|
||||
skillLevel: intermediate
|
||||
url: https://github.com/ydkhatri/spotlight_parser
|
||||
icon: 🔍
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows
|
||||
accessType: download
|
||||
license: MIT
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- spotlight-analysis
|
||||
- metadata-parser
|
||||
- deleted-file-recovery
|
||||
- search-history
|
||||
- python-tool
|
||||
- macos-artifacts
|
||||
- user-activity
|
||||
related_concepts:
|
||||
- File Systems & Storage Forensics
|
||||
related_software:
|
||||
- ALEAPP
|
||||
- iLEAPP
|
||||
|
||||
- name: FSEventsParser
|
||||
type: software
|
||||
description: >-
|
||||
Dekodiert macOS-FSEvents-Logs für vollständige Dateisystem-Aktivitäts-Timeline ohne Lücken. Trackt Datei-Creation, Modification, Deletion und Movement auch bei gelöschten Files. Besonders wertvoll: Millisecond-Precision-Timestamps, Volume-übergreifende Tracking, Correlation mit anderen Artefakten. Python-basierte Parsing-Engine für Command-Line-Integration. Standard-Tool für macOS-Timeline-Forensik und Incident-Reconstruction.
|
||||
skillLevel: intermediate
|
||||
url: https://github.com/dlcowen/FSEventsParser
|
||||
icon: 📊
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows
|
||||
accessType: download
|
||||
license: GPL-3.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- timeline-analysis
|
||||
- filesystem-monitoring
|
||||
- python-tool
|
||||
- macos-artifacts
|
||||
- deleted-file-recovery
|
||||
- high-precision
|
||||
- correlation-engine
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
- File Systems & Storage Forensics
|
||||
related_software:
|
||||
- Plaso (log2timeline)
|
||||
- Timesketch
|
||||
|
||||
- name: chainbreaker
|
||||
type: software
|
||||
description: >-
|
||||
Python-Tool extrahiert Passwörter, Zertifikate und Schlüssel aus macOS-Keychain-Dateien für Credential-Recovery. Dekryptiert sowohl Login- als auch System-Keychains mit User-Passwort oder Master-Key. Besonders wertvoll: WiFi-Passwort-Extraktion, Certificate-Chain-Analysis, Secure-Notes-Dekodierung. Batch-Processing für Enterprise-Deployments. Export in strukturierte Formate für weitere Analyse. Standard für macOS-Credential-Forensik.
|
||||
skillLevel: advanced
|
||||
url: https://github.com/n0fate/chainbreaker
|
||||
icon: ⛓️
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows
|
||||
accessType: download
|
||||
license: GPL-3.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- credential-extraction
|
||||
- keychain-analysis
|
||||
- password-recovery
|
||||
- certificate-analysis
|
||||
- python-tool
|
||||
- macos-artifacts
|
||||
- wifi-passwords
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software:
|
||||
- hashcat
|
||||
|
||||
- name: UnifiedLogReader
|
||||
type: software
|
||||
description: >-
|
||||
Alpha-Stadium-Parser für macOS-Unified-Logging-System analysiert strukturierte Logd-Datenbanken für System-Event-Reconstruction. Extrahiert versteckte Debug-Messages, Kernel-Events und App-Crashes aus tracev3-Files. Besonders wertvoll bei Malware-Persistenz-Analysis und System-Tampering-Detection. Korreliert Events über Process-Boundaries hinweg. Experimentelle Software mit begrenzter Stability aber einzigartige Capabilities.
|
||||
skillLevel: expert
|
||||
url: https://github.com/ydkhatri/UnifiedLogReader
|
||||
icon: 📜
|
||||
domains:
|
||||
- incident-response
|
||||
- malware-analysis
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows
|
||||
accessType: download
|
||||
license: MIT
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- log-parser
|
||||
- unified-logs
|
||||
- python-tool
|
||||
- macos-artifacts
|
||||
- system-events
|
||||
- kernel-analysis
|
||||
- experimental
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
related_software:
|
||||
- Plaso (log2timeline)
|
||||
- Aftermath
|
||||
|
||||
- name: xmount
|
||||
type: software
|
||||
description: >-
|
||||
Virtuelles Dateisystem mountet forensische Images als Block-Devices für Live-Analyse ohne Extraktion. Unterstützt EWF, AFF, RAW und DMG-Formate mit gleichzeitiger Konvertierung zwischen Formaten. Besonders wertvoll: Cache-System beschleunigt wiederholte Zugriffe, Write-Cache simuliert beschreibbare Images für Tests. FUSE-basierte Architektur für Linux/macOS-Integration. Perfekt für Timeline-Tools die direkten Disk-Zugriff benötigen.
|
||||
skillLevel: intermediate
|
||||
url: https://www.pinguin.lu/xmount
|
||||
icon: 🗄️
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: GPL-3.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- virtual-filesystem
|
||||
- image-mounting
|
||||
- format-conversion
|
||||
- fuse-based
|
||||
- cache-system
|
||||
- write-simulation
|
||||
- cross-format
|
||||
related_concepts:
|
||||
- File Systems & Storage Forensics
|
||||
related_software:
|
||||
- OSFMount
|
||||
- ewfmount
|
||||
|
||||
- name: ewfmount
|
||||
type: software
|
||||
description: >-
|
||||
FUSE-Wrapper mountet Expert-Witness-Format-Images als reguläre Files für Standard-Tool-Zugriff. Teil der libewf-Suite ermöglicht Read-Only-Access auf E01/Ex01-Segmente ohne Vollextraktion. Besonders praktisch: Integration in Standard-Workflows, Performance-Optimierung für große Archives, Metadata-Preservation. Cross-Platform-Verfügbarkeit für heterogene Lab-Umgebungen. Alternative zu proprietären Mounting-Tools.
|
||||
skillLevel: beginner
|
||||
url: https://github.com/libyal/libewf/wiki/Mounting
|
||||
icon: 📁
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
platforms:
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: LGPL-3.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- ewf-mounting
|
||||
- fuse-filesystem
|
||||
- read-only
|
||||
- segment-handling
|
||||
- cross-platform
|
||||
- libewf-suite
|
||||
- performance-optimized
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- xmount
|
||||
- ewfacquire
|
||||
|
||||
- name: iPhone Backup Extractor
|
||||
type: software
|
||||
description: >-
|
||||
Kommerzielle iOS-Backup-Analysis-Suite extrahiert Daten aus iTunes/Finder-Backups inklusive verschlüsselter Archives. Dekodiert App-Sandboxes, Keychain-Items und gelöschte SQLite-Records für umfassende iOS-Forensik. Besonders wertvoll: GUI für nicht-technische Ermittler, automatische App-Erkennung, Timeline-Export. Unterstützt iOS 3-17 mit regelmäßigen Updates. Premium-Features für Location-Data und Advanced-Recovery.
|
||||
skillLevel: beginner
|
||||
url: https://www.3utools.com/iphone-backup-extractor/
|
||||
icon: 📱
|
||||
domains:
|
||||
- mobile-forensics
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
- macOS
|
||||
accessType: commercial
|
||||
license: Proprietary
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- gui
|
||||
- ios-backup
|
||||
- commercial
|
||||
- keychain-extraction
|
||||
- app-analysis
|
||||
- timeline-export
|
||||
- encrypted-backup
|
||||
- sqlite-recovery
|
||||
related_concepts:
|
||||
- SQL
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software:
|
||||
- iLEAPP
|
||||
- Cellebrite UFED
|
||||
|
||||
- name: tmutil
|
||||
type: software
|
||||
description: >-
|
||||
Time-Machine-Utility steuert macOS-Backup-System und analysiert Snapshot-Strukturen für forensische Timeline-Reconstruction. Listet verfügbare Backups, vergleicht Versionen und extrahiert historische File-States. Besonders wertvoll: Point-in-Time-Recovery für Evidence, Metadata-Analyse von Backup-Changes, APFS-Snapshot-Integration. Thin-Backup-Analysis reduziert Storage-Overhead. Command-Line-Access für Scripting-Integration.
|
||||
skillLevel: intermediate
|
||||
url: https://ss64.com/osx/tmutil.html
|
||||
icon: ⏰
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- macOS
|
||||
accessType: built-in
|
||||
license: Proprietary
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- cli
|
||||
- backup-analysis
|
||||
- snapshot-examination
|
||||
- apfs-snapshots
|
||||
- version-comparison
|
||||
- timeline-reconstruction
|
||||
- point-in-time-recovery
|
||||
- metadata-analysis
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
- File Systems & Storage Forensics
|
||||
related_software:
|
||||
- ShadowExplorer
|
||||
- hdiutil
|
||||
- name: macOS Target Disk Mode Acquisition
|
||||
type: method
|
||||
description: >-
|
||||
Forensische Datensammlung über Target Disk Mode (TDM) durch Drücken der T-Taste beim Boot-Vorgang.
|
||||
Das Asservat verhält sich wie eine externe Festplatte über Firewire/Thunderbolt-Verbindung.
|
||||
Vollständiges Verfahren: 1) Hardware-Schreibblocker anschließen, 2) T-Taste beim Boot drücken,
|
||||
3) Ziel-Mac per Firewire/Thunderbolt verbinden, 4) Imaging mit dd/hdiutil durchführen.
|
||||
Limitierungen: nur erste Festplatte verfügbar, Firmware-Passwort blockiert TDM,
|
||||
Benutzerpasswort für FileVault-Entschlüsselung erforderlich.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 🎯
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- data-collection
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- live-acquisition
|
||||
- target-disk-mode
|
||||
- hardware-connection
|
||||
- write-blocker-required
|
||||
- firmware-limitation
|
||||
- password-dependent
|
||||
- scenario:disk_imaging
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- dd
|
||||
|
||||
- name: macOS Auto-Mount Prevention
|
||||
type: method
|
||||
description: >-
|
||||
Verhinderung automatischen Mountens durch temporäres Deaktivieren des Disk Arbitrators.
|
||||
Verfahren: 1) 'sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist' ausführen,
|
||||
2) Datenträger anschließen (kein diskutil verfügbar), 3) Imaging durchführen,
|
||||
4) 'sudo launchctl load /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist' zur Reaktivierung.
|
||||
Alternative zu Hardware-Schreibblockern für forensisch saubere Anbindung.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 🚫
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- data-collection
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- write-blocker
|
||||
- disk-arbitrator
|
||||
- system-modification
|
||||
- contamination-prevention
|
||||
- sudo-required
|
||||
- manual-mounting
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software: []
|
||||
|
||||
- name: macOS Property List Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Systematische Auswertung von Apple Property List Dateien (Plist) in XML- und
|
||||
Binärformat für Konfigurationsdaten und Systemeinstellungen. Konvertierung zwischen
|
||||
Formaten mit plutil-Tool, strukturierte Analyse des binären Objektaufbaus mit 8-Byte-Header,
|
||||
variabler Objekttabelle, Offset-Tabelle und 32-Byte-Trailer. Extraktion forensischer
|
||||
Artefakte aus Systemkonfigurationen, Anwendungseinstellungen und Benutzeraktivitäten.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 📋
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
- mobile-forensics
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- plist-analysis
|
||||
- binary-decode
|
||||
- configuration-parsing
|
||||
- system-metadata
|
||||
- artifact-extraction
|
||||
- format-conversion
|
||||
- xml-parsing
|
||||
related_concepts: []
|
||||
related_software: []
|
||||
|
||||
- name: macOS Spotlight Forensic Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Tiefgehende Auswertung der Spotlight-Indexdatenbanken (.store-Dateien) für umfassende
|
||||
Dateimetadaten und Aktivitätsnachweise. Extraktion von Öffnungshäufigkeiten, letzten
|
||||
Zugriffsdaten und versteckten Metadaten die im normalen Dateisystem nicht verfügbar sind.
|
||||
Fundorte: /.Spotlight-V100/Store-V2/<UUID>/.store und ~/Library/Metadata/CoreSpotlight/.
|
||||
Analyse erfordert spezielle Python-Parser für proprietäres undokumentiertes Format.
|
||||
skillLevel: advanced
|
||||
url: ""
|
||||
icon: 🔍
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- spotlight-analysis
|
||||
- metadata-extraction
|
||||
- timeline-analysis
|
||||
- file-activity
|
||||
- indexing-forensics
|
||||
- database-parsing
|
||||
- python-tools
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
related_software: []
|
||||
|
||||
- name: macOS FSEvents Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Forensische Auswertung von FSEvents-Logs für historische Dateisystemänderungen seit macOS 10.7.
|
||||
Fundort: /.fseventsd/xxxxxxxxxx (gzip-komprimiert). Dateiname entspricht letzter Event-ID + 1.
|
||||
Dekomprimierung und Parsing für chronologische Rekonstruktion von Datei-/Ordner-Operationen.
|
||||
Besonderheit: alphabetische statt chronologische Speicherung erfordert spezielle Parser
|
||||
für zeitbasierte Analyse und Aktivitätsmuster-Erkennung.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 📁
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- fsevents-analysis
|
||||
- filesystem-monitoring
|
||||
- historical-analysis
|
||||
- gzip-decompression
|
||||
- timeline-reconstruction
|
||||
- file-operations
|
||||
- activity-tracking
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
- File Systems & Storage Forensics
|
||||
related_software: []
|
||||
|
||||
- name: macOS Keychain Forensic Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Extraktion und Entschlüsselung von Passwörtern aus macOS Keychain-Dateien
|
||||
(~/Library/Keychains/*) für Zugangsdaten-Recovery. Auf T2/M1-Systemen Hardware-Bindung
|
||||
durch HEK-Schlüssel, Entschlüsselung nur mit bekanntem Benutzerpasswort möglich.
|
||||
Neuere Versionen: Export-Funktion deaktiviert, Alternative über Safari-Password-Manager
|
||||
(CSV-Export) oder Python-Chainbreaker-Tools für Offline-Analyse.
|
||||
skillLevel: advanced
|
||||
url: ""
|
||||
icon: 🔐
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
- fraud-investigation
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- keychain-analysis
|
||||
- password-extraction
|
||||
- hardware-encryption
|
||||
- credential-recovery
|
||||
- t2-m1-limitations
|
||||
- python-tools
|
||||
- access-restriction
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software: []
|
||||
|
||||
- name: macOS Unified Log Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Dekodierung und Analyse des Apple Unified Logging (AUL) ab macOS 10.12 für
|
||||
systemweite Event-Korrelation. Datenquellen: /var/db/diagnostics/Persist/ (tracev3-Dateien),
|
||||
/var/db/diagnostics/Special/ und /var/db/uuidtext. Analyse mit 'log show', 'log collect',
|
||||
Predicate-Filter für gezielte Suchen. Offline-Analyse erfordert Übertragung der
|
||||
Verzeichnisse auf Analyse-Mac oder Virtualisierung des Zielsystems.
|
||||
skillLevel: advanced
|
||||
url: ""
|
||||
icon: 📊
|
||||
domains:
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- unified-logging
|
||||
- tracev3-parsing
|
||||
- predicate-filters
|
||||
- subsystem-analysis
|
||||
- binary-log-format
|
||||
- timeline-creation
|
||||
- system-monitoring
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
related_software: []
|
||||
|
||||
- name: macOS DMG Image Mounting
|
||||
type: method
|
||||
description: >-
|
||||
Forensisch sauberes Mounting von Mac Disk Images mit Write-Protection. Verfahren:
|
||||
1) DMG-Datei als 'geschützt' markieren (Schloss-Icon), 2) 'hdiutil attach -shadow'
|
||||
für Shadow-File-Erstellung, 3) 'mdutil -i on' für Spotlight-Indexierung ohne Original-Änderung.
|
||||
Alternative: RAW/E01-Images mit xmount zu DMG konvertieren. Ermöglicht native macOS-Tool-Nutzung
|
||||
und Spotlight-Durchsuchbarkeit bei forensischer Integrität.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 💿
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- dmg-mounting
|
||||
- write-protection
|
||||
- shadow-files
|
||||
- spotlight-indexing
|
||||
- image-conversion
|
||||
- forensic-imaging
|
||||
- read-only-access
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- OSFMount
|
||||
|
||||
- name: macOS Time Machine Backup Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Forensische Auswertung von Time Machine Backups für historische Systemzustände.
|
||||
Bis macOS 10.x: HFS+-Sparse-Bundle mit Hardlinks, ab BigSur: APFS-Snapshots.
|
||||
Analyse-Befehle: 'tmutil listbackups', 'tmutil listlocalsnapshots', 'tmutil destinationinfo'.
|
||||
Backup-Struktur: stündlich (24h), täglich (1 Monat), wöchentlich (permanent).
|
||||
Auswertung der backup_manifest.plist für Snapshot-IDs und Timeline-Rekonstruktion.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: ⏰
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- time-machine-analysis
|
||||
- backup-forensics
|
||||
- sparse-bundle
|
||||
- apfs-snapshots
|
||||
- hardlink-analysis
|
||||
- historical-recovery
|
||||
- manifest-parsing
|
||||
related_concepts:
|
||||
- Timeline Analysis & Event Correlation
|
||||
- File Systems & Storage Forensics
|
||||
related_software: []
|
||||
|
||||
- name: iOS Backup Forensic Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Extraktion und Analyse von iTunes/iCloud-Backups für iOS-Geräte-Forensik.
|
||||
Fundorte: Windows: /Users/[User]/AppData/Roaming/Apple Computer/MobileSync/Backup/,
|
||||
macOS: ~/Library/Application Support/MobileSync/Backup/. UDID-basierte Ordnerstruktur
|
||||
(SHA1 aus Seriennummer/IMEI/MAC), GUID-benannte Dateien enthalten iOS-Dateisystem-Inhalte.
|
||||
Analyse von Info.plist, Manifest.plist, Status.plist für Backup-Metadaten.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 📱
|
||||
domains:
|
||||
- mobile-forensics
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- ios-backup-analysis
|
||||
- udid-decoding
|
||||
- manifest-parsing
|
||||
- app-data-recovery
|
||||
- backup-decryption
|
||||
- mobile-artifacts
|
||||
- itunes-backup
|
||||
related_concepts:
|
||||
- SQL
|
||||
- Digital Evidence Chain of Custody
|
||||
related_software:
|
||||
- Cellebrite UFED
|
||||
|
||||
- name: macOS iCloud Artifact Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Systematische Auswertung von iCloud-Synchronisations-Artefakten im lokalen Dateisystem.
|
||||
Fundorte: ~/Library/Application Support/iCloud/Accounts (iCloud-ID),
|
||||
~/Library/Mobile Documents/ (synchronisierte Dateien), ~/Library/SyncedPreferences/ (App-Einstellungen),
|
||||
~/Library/Application Support/CloudDocs/ (client.db/server.db). Extraktion der account.1-Datei
|
||||
und .DS_Store-Analyse für Cloud-Aktivitätsnachweise ohne direkten iCloud-Zugriff.
|
||||
skillLevel: advanced
|
||||
url: ""
|
||||
icon: ☁️
|
||||
domains:
|
||||
- cloud-forensics
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- icloud-forensics
|
||||
- cloud-synchronization
|
||||
- mobile-documents
|
||||
- token-extraction
|
||||
- sync-analysis
|
||||
- cloud-artifacts
|
||||
- metadata-analysis
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software: []
|
||||
|
||||
- name: macOS Communication App Analysis
|
||||
type: method
|
||||
description: >-
|
||||
Forensische Untersuchung nativer macOS Kommunikations-Apps für Nachrichtenverlauf.
|
||||
Messages: chat.db-SQLite-Datenbank (Tabellen: chat, messages, handle, attachments),
|
||||
Attachments-Verzeichnis. Mail: Envelope Index-Datenbank, .emlx-Dateien, Accounts-SQLite.
|
||||
Kontakte: AddressBook-v22.abcddb, MailRecents-v4.abcdmr. FaceTime: Plist-Konfigurationen
|
||||
mit Anruflisten. Korrelation zwischen Apps und iOS-Synchronisation.
|
||||
skillLevel: intermediate
|
||||
url: ""
|
||||
icon: 💬
|
||||
domains:
|
||||
- static-investigations
|
||||
- fraud-investigation
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms: []
|
||||
accessType: null
|
||||
license: null
|
||||
knowledgebase: true
|
||||
tags:
|
||||
- communication-analysis
|
||||
- chat-db-analysis
|
||||
- message-recovery
|
||||
- attachment-extraction
|
||||
- contact-analysis
|
||||
- ios-synchronization
|
||||
- sqlite-parsing
|
||||
related_concepts:
|
||||
- SQL
|
||||
- Timeline Analysis & Event Correlation
|
||||
related_software: []
|
||||
domains:
|
||||
- id: incident-response
|
||||
name: Incident Response & Breach-Untersuchung
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user