Difference between pages "Mac OS X" and "Category:Disk imaging"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Disk image types)
 
(Unix-based imagers)
 
Line 1: Line 1:
{{Expand}}
+
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
 +
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
 +
</div>
  
Apple Inc.'s Macintosh OS X (pronounced "'''OS Ten'''") is the operating system distributed with Apple computers. It includes heavily used several programs by default, including [[Apple Mail]], a web browser called [[Apple Safari | Safari]], and an [[Apple Address Book]], and [[iCal]].
+
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
  
== Disk image types ==
+
= Hardware imagers =
 +
; [[DFL-DE Data Recovery Tool]]
 +
: Including three main modules: disk imaging modules, file recovery modules and automatic hdd repair modules, fixing both detected and undetected hard drives. http://www.datarecoverytools4u.com/product/data-extractor-dfl-de/.
 +
;[[Data Compass]]
 +
:A hardware and software tool by [[SalvationDATA]] that can image data from bad sectors, unstable heads and other drives.
 +
; [[DeepSpar Disk Imager]]
 +
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html  - Data Sheet and Whitepaper available for download from product web page.
 +
; [[ICS Solo3]]
 +
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
 +
; [[Logicube Talon]]
 +
: Supports USB
 +
; [[PSIClone]]
 +
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
 +
: Enhanced Error Handling and Logging
 +
; [[Voom HardCopy III]]
 +
: Allows destination drive to be formatted in NTFS.
  
Mac OS X has support for various disk image types build-in, some of which are:
+
= Unix-based imagers=
* read-write disk image (.dmg) some of which use the [[Raw Image Format]]
+
* [[Sparse Image format|Sparse disk image (.spareimage)]]
+
* [[Sparse Bundle Image format|Sparse bundle disk image (.sparsebundle)]]
+
  
== Burn Folder ==
+
; '''ewfacquire''', '''ewfacquirestream'''
 +
: The tools '''ewfacquire''' and '''ewfacquiresteam''' are part of the [[libewf]] library package. They can create evidence files in the [[EnCase]] and [[FTK Imager]] .E0* (EWF-E01) and [[SMART]] .s0* (EWF-S01) formats. '''ewfacquire''' is intended to read from devices and '''ewfacquirestream''' from pipes. Both tools calculate an [[MD5]] hash on default while the data is being acquired. They are able to calculate a [[SHA1]] message digest as well, but because of compatibility with [[EnCase]] they only store the [[SHA1]] hash in the Extended EWF (EWF-X) format. '''ewfacquire''' and '''ewfacquirestream''' provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
 +
: [[libewf|https://code.google.com/p/libewf/]]
  
Mac OS X Burn Folder:
+
; [[Adepto]]
<pre>
+
: http://www.e-fense.com/helix/
$NAME.fpbf
+
</pre>
+
  
This folder normally contains [[Mac OS X Alias Files|alias files]] (similar to LNK files under Windows). Which should have the following signature.
+
; [[aimage]]
<pre>
+
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]] can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
00000000 62 6f 6f 6b 00 00 00 00  6d 61 72 6b 00 00 00 00  |book....mark....|
+
</pre>
+
  
These [[Mac OS X Alias Files|alias files]] contain additional date and time values.
+
; [[AIR]]
 +
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
 +
: http://air-imager.sourceforge.net/
  
Also check the following files for references to deleted .fpbf paths:
+
; [[dcfldd]]
<pre>
+
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
/Users/$USERNAME/Library/Preferences/com.apple.finder.plist
+
/Users/$USERNAME/Library/Preferences/com.apple.sidebarlists.plist
+
</pre>
+
  
Actual burning of optical media is logged in:
+
; [[dd]]
<pre>
+
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
/var/log/system.log
+
/Users/$USERNAME/Library/Logs/DiscRecording.log
+
/private/var/.logs_exporter/cache/Users/$USERNAME/Library/Logs/DiscRecording.log
+
</pre>
+
  
== HFS/HFS+ date and time values ==
+
; EnCase [[LinEn]]
 +
: Linux-based version of EnCase's forensic imaging tool.
  
In HFS+ date and time values are stored in an unsigned 32-bit integer containing the number of seconds since January 1, 1904 at 00:00:00 (midnight) UTC (GMT). This is slightly different from HFS where the date and time value are stored using the local time. The maximum representable date is February 6, 2040 at 06:28:15 UTC (GMT). The date values do not account for leap seconds. They do include a leap day in every year that is evenly divisible by four. This is sufficient given that the range of representable dates does not contain 1900 or 2100, neither of which have leap days. Also see: [http://web.archive.org/web/20090214212148/http://developer.apple.com/technotes/tn/tn1150.html Technical Note TN1150 - HFS Plus Volume Format]
+
; GNU [[ddrescue]]
 +
: http://www.gnu.org/software/ddrescue/ddrescue.html
  
Converting HFS/HFS+ date and time values with Python:
+
; [[dd_rescue]]
<pre>
+
: http://www.garloff.de/kurt/linux/ddrescue/
import datetime
+
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
  
print datetime.datetime( 1904, 1, 1 ) + datetime.timedelta( seconds=0xCBDAF25B )
+
; iLook [[IXimager]]
</pre>
+
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
  
== Quarantine event database ==
+
; [[MacQuisition Boot CD]]
See [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/]
+
: Provides software to safely image [[Macintosh]] drives.
  
Snow Leopard and earlier
+
; [[rdd]]
<pre>
+
: http://sourceforge.net/projects/rdd
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEvents
+
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
</pre>
+
  
<pre>
+
; [[sdd]]
SELECT datetime(LSQuarantineTimeStamp + 978307200, "unixepoch") as LSQuarantineTimeStamp, LSQuarantineAgentName, LSQuarantineOriginURLString, LSQuarantineDataURLString from LSQuarantineEvent;
+
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
</pre>
+
  
Lion and later
+
= Windows-based imagers =
<pre>
+
/Users/$USER/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
+
</pre>
+
  
== sleepimage ==
+
; [[AccessData]]
This file is similar to the hibernation file on Windows.
+
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
<pre>
+
/private/var/vm/sleepimage
+
</pre>
+
  
Also see: [http://osxdaily.com/2010/10/11/sleepimage-mac/]
+
; [[ASR]]
 +
: A tool for [[imaging]] and analyzing disks.
  
== Package Files (.PKG) ==
+
; [[DIBS]]
Package Files (.PKG) are XAR archives [http://en.wikipedia.org/wiki/Xar_(archiver)] that contain a cpio archive and metadata [http://s.sudre.free.fr/Stuff/Ivanhoe/FLAT.html].
+
: Can image and convert many file formats. Also builds mobile toolkit.
  
== Also see ==
+
; [[EnCase]]
* [[MacOS Process Monitoring]]
+
: Can image with out dongle plugged in. Only images to E0* file.
* [[Acquiring a MacOS System with Target Disk Mode]]
+
* [[Converting Binary Plists]]
+
* [[FileVault Disk Encryption]]
+
* [[File Vault]]
+
  
== External Links ==
+
; [[FTK Imager]] by [[AccessData]]
 +
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
  
* [http://www.apple.com/macosx/ Official website]
+
; [[Ghost]]
* [http://en.wikipedia.org/wiki/OS_X Wikipedia entry on OS X]
+
: FTK can read forensic, uncompressed [[Ghost image]]s.
* [http://menial.co.uk/blog/2011/06/16/mac-quarantine-event-database/ Quarantine event database]
+
* [http://www2.tech.purdue.edu/cit/Courses/cit556/readings/MacForensicsCraiger.pdf Mac Forensics: Mac OS X and the HFS+ File System] by P. Craiger
+
* [http://web.me.com/driley/iWeb/Previous_files/Directory_Services_Overview.pdf Mac OS X Directory Services Integration including Active Directory]
+
* [http://digitalinvestigation.wordpress.com/2012/04/04/geek-post-nskeyedarchiver-files-what-are-they-and-how-can-i-use-them/ NSKeyedArchiver files – what are they, and how can I use them?]
+
* [http://krypted.com/mac-os-x/command-line-alf-on-mac-os-x/ Command Line ALF on Mac OS X]
+
* [http://newosxbook.com/DMG.html Demystifying the DMG File Format]
+
  
=== Apple Examiner ===
+
; [[iLook]]
* [http://www.appleexaminer.com/ The Apple Examiner]
+
: The [[IRS]]'s set of forensic tools and utilities. iLook V8 can image in Windows.
* [http://www.appleexaminer.com/MacsAndOS/Analysis/USBOSX/USBOSX.html USB Entries on OS X]
+
* [http://www.appleexaminer.com/Downloads/MacForensics.pdf Macintosh Forensics - A Guide for the Forensically Sound Examination of a Macintosh Computer] by Ryan R. Kubasiak
+
  
[[Category:Mac OS X]]
+
; [[Paraben]]
[[Category:Operating systems]]
+
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
 +
 
 +
; [[ProDiscovery]]
 +
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
 +
 
 +
; [[X-Ways Forensics]]  
 +
: Has some limited imaging capabilities. The output is [[raw format]].
 +
 
 +
; [[X-Ways Replica]]
 +
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
 +
 
 +
 
 +
[[Category:Tools]]
 +
 
 +
[[Category:Tools]]

Revision as of 01:33, 15 July 2013

Note: We're trying to use the same tool template for all devices. Please use this if possible.

TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...

Hardware imagers

DFL-DE Data Recovery Tool
Including three main modules: disk imaging modules, file recovery modules and automatic hdd repair modules, fixing both detected and undetected hard drives. http://www.datarecoverytools4u.com/product/data-extractor-dfl-de/.
Data Compass
A hardware and software tool by SalvationDATA that can image data from bad sectors, unstable heads and other drives.
DeepSpar Disk Imager
Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html - Data Sheet and Whitepaper available for download from product web page.
ICS Solo3
Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
Logicube Talon
Supports USB
PSIClone
Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
Enhanced Error Handling and Logging
Voom HardCopy III
Allows destination drive to be formatted in NTFS.

Unix-based imagers

ewfacquire, ewfacquirestream
The tools ewfacquire and ewfacquiresteam are part of the libewf library package. They can create evidence files in the EnCase and FTK Imager .E0* (EWF-E01) and SMART .s0* (EWF-S01) formats. ewfacquire is intended to read from devices and ewfacquirestream from pipes. Both tools calculate an MD5 hash on default while the data is being acquired. They are able to calculate a SHA1 message digest as well, but because of compatibility with EnCase they only store the SHA1 hash in the Extended EWF (EWF-X) format. ewfacquire and ewfacquirestream provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
https://code.google.com/p/libewf/
Adepto
http://www.e-fense.com/helix/
aimage
Part of the AFF system, aimage can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied. It has intelligent error recovery, similar to what is in ddrescue.
AIR
AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
http://air-imager.sourceforge.net/
dcfldd
A version of dd created by the Digital Computer Forensics Laboratory. dcfldd is an enhanced version of GNU dd with features useful for forensics and security, such as calculating MD5 or SHA-1 hashes on the fly and faster disk wiping.
dd
A program that converts and copies files, is one of the oldest Unix programs. I can copy data from any Unix "file" (including a raw partition) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces raw image files. Extended into dcfldd.
EnCase LinEn
Linux-based version of EnCase's forensic imaging tool.
GNU ddrescue
http://www.gnu.org/software/ddrescue/ddrescue.html
dd_rescue
http://www.garloff.de/kurt/linux/ddrescue/
A tool similar to dd, but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
iLook IXimager
The primary imaging tool for iLook. It is Linux based and produces compressed authenticatable image files that may only be read in the iLook analysis tool.
MacQuisition Boot CD
Provides software to safely image Macintosh drives.
rdd
http://sourceforge.net/projects/rdd
Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
sdd
Another dd-like tool. It is supposed to be faster in certain situations.

Windows-based imagers

AccessData
Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
ASR
A tool for imaging and analyzing disks.
DIBS
Can image and convert many file formats. Also builds mobile toolkit.
EnCase
Can image with out dongle plugged in. Only images to E0* file.
FTK Imager by AccessData
Can image and convert many image formats. Including E0* (EWF-E01), s0* (EWF-S01) and dd. Also a free tool.
Ghost
FTK can read forensic, uncompressed Ghost images.
iLook
The IRS's set of forensic tools and utilities. iLook V8 can image in Windows.
Paraben
A complete set of tools for Windows (and handheld) products.
ProDiscovery
Images and searches FAT12, FAT16, FAT32 and all NTFS files.
X-Ways Forensics
Has some limited imaging capabilities. The output is raw format.
X-Ways Replica
Performs hard disk cloning and imaging. The output is raw format.