0xED is a native OS X hex editor based on the Cocoa framework. Fast editing of large files. Unlimited file size (limited by what the actual file system supports). Requires Mac OS X 10.6 or newer. Intel 32/64 bit binary. Localizations available: Italian, Finnish, French, German, Simplified Chinese.
Digital forensic and incident response investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iDevice? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms. Dealing with these devices as an investigator is no longer a niche skill - every analyst must have the core skills necessary to investigate the Apple devices they encounter.
Great photographers are made, not born, and even the best photographers have plenty of unimpressive shots in their collections. But in the age of digital photography, it’s possible to create a great photograph without being a great photographer. You can even accomplish this days after snapping your photo, so long as you have the right post-processing software and a little time to play around.
The constantly updated course provides the techniques and skills necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. In addition to traditional investigations, the course presents intrusion and incident response scenarios to help analysts learn ways to identify and hunt down attackers that have compromised Apple devices.
Forensicate Differently! FOR518: Mac and iOS Forensic Analysis and Incident Response will teach you: • Mac and iOS Fundamentals: How to analyze and parse the Hierarchical File System (HFS+) and Apple File System (APFS) by hand and recognize the specific domains of the logical file system and Mac-specific file types.
• User Activity: How to understand and profile users through their data files and preference configurations. • Advanced Intrusion Analysis and Correlation: How to determine how a system has been used or compromised by using the system and user data files in correlation with system log files. • Apple Technologies: How to understand and analyze many Mac and iOS-specific technologies, including Time Machine, Spotlight, iCloud, Document Versions, FileVault, Continuity, and FaceTime. FOR518: Mac and iOS Forensic Analysis and Incident Response aims to train a well-rounded investigator by diving deep into forensic and intrusion analysis of Mac and iOS.
The course focuses on topics such as the HFS+ and APFS file systems, Mac-specific data files, tracking of user activity, system configuration, analysis and correlation of Mac logs, Mac applications, and Mac-exclusive technologies. A computer forensic analyst who completes this course will have the skills needed to take on a Mac or iOS forensics case. Overview This section contains a wide array of information that can be used to profile and understand how individuals use their computers. Salted or unsalted butter for mashed potatoes. The logical Mac file system is made up of four domains: User, Local, System, and Network. The User Domain contains most of the user-related items of forensic interest. This domain consists of user preferences and configurations. The Local and System Domains contain system-specific information such as application installation, system settings and preferences, and system logs.
This section details basic system information, GUI preferences, and system application data. A basic analysis of system logs can provide a good understanding of how a system was used or abused. The Network domain is more ethereal and we can find this in many places throughout the course as well as in the logs. Timeline analysis tells the story of how the system was used. Each entry in a log file has a specific meaning and may be able to tell how the user interacted with the computer. The log entries can be correlated with other data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently. Analysis tools and techniques will be used to correlate the data and help the student put the story back together in a coherent and meaningful way.