Mac OS X Forensics: Conclusion

Mac OS x and iOS Handoff

RESULTS

With the semester coming to a close, the projects are wrapping up and the reports are rolling out. We are diving into examining the devices we used for the Handoff feature and are currently finding data that points to its use. Below you can see a Handoff request that was found in the devices system.log file:

macosx1

Since there was not enough time to complete a report this semester, we are creating detailed notes of our findings which will be used next semester when we write the final report.

The Mac OS X Artifact Locations report has been completed; full details of the artifacts locations are included. Our report covers a comparison of the artifact locations in OS X Lion and OS X Yosemite where we found obsolete locations (artifacts are no longer in Yosemite) and new locations. We looked into over 100 different artifacts; we found a handful of new artifact locations, locations that stayed the same, and some that were missing or not able to be generated in a VM. Generating the missing artifacts is our future work goal and will be looked into; this will be done on a physical machine in order to bypass the VM’s limitations. We have included file paths to the locations in Yosemite and all of the new artifacts have screenshots showing the file path location. To see our full findings, visit the LCDI’s website and read our report.