Several macOS new artifacts #294

pstirparo · 2018-10-19T11:41:44Z

Added several new artifacts and corrected the path of the one related to Apple Mail application (new versions can have the path different from "V2", but still always V followed by one digit --> "V[0-9]")

codecov · 2018-10-19T12:33:56Z

Codecov Report

Merging #294 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #294   +/-   ##
=======================================
  Coverage   91.08%   91.08%           
=======================================
  Files           7        7           
  Lines         415      415           
=======================================
  Hits          378      378           
  Misses         37       37

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 60d4829...5c6dbb6. Read the comment docs.

joachimmetz · 2018-10-22T14:03:40Z

data/macos.yaml

+- type: FILE
+  attributes:
+    paths:
+    - '/var/db/diagnostics/Persist/logdata.Persistent.YYYYMMDD THHMMSS.tracev3'


I assume YYYYMMDD THHMMSS should be a wild card? also is the space in the string?

Correct, I will change "YYYYMMDD THHMMSS" with "*".
The space was a typo

Know that "YYYYMMDDTHHMMSS" will result in an exact string match

not a glob "[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]T[0-9][0-9][0-9][0-9][0-9][0-9]"

As mentioned in my comments on the PR #298 , I'm referring specifically to the log files *.tracev3 and the resource files under uuidtext folder (this leaves out the log statistics file for example, which are in the same folder). would you prefer to keep them anyway?

joachimmetz · 2018-10-22T14:04:56Z

data/macos.yaml

@@ -369,7 +401,7 @@ name: MacOSMailAccounts
 doc: Mail Accounts
 sources:
 - type: FILE
-  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Accounts.plist']}
+  attributes: {paths: ['%%users.homedir%%/Library/Mail/V[0-9]/MailData/Accounts.plist']}


Have we seen all 0-9 versions? or is this 1-3 ?

I have seen V2, V3 and V5, I thought 0-9 was good to be on the safe side.

ack, SG; maybe add this to the doc string that V2, V3 and V5 have been observed?

joachimmetz · 2018-10-22T14:06:14Z

data/macos.yaml

@@ -600,6 +658,14 @@ urls:
 - 'http://forensicswiki.org/wiki/Mac_OS_X'
 - 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Skype'
 ---
+name: MacOSSkypeMainDirectory


Seeing this is a cross platform application I opt to move this to applications definitions file

ok, I will remove it. Given that there were already Skype related artifacts I just added some new ones. I will start an im application specific yaml file with those in it.

joachimmetz · 2018-10-22T14:06:37Z

data/macos.yaml

+  attributes: {paths: ['%%users.homedir%%/Library/Application Support/Skype/*']}
+labels: [Users, Software, IM]
+supported_os: [Darwin]
+---
 name: MacOSSkypePreferences


This one likely as well

Fixed (see above)

joachimmetz · 2018-10-22T14:07:58Z

data/macos.yaml

+labels: [Users, Logs]
+supported_os: [Darwin]
+---
+name: MacOSPasswordHashes


Doesn't this contain broader account information?

Indeed, it has other general account info like home directory, default shells, home dir path, original full user name, user profile picture, etc. Shall we use one of the following

name: MacOSUsersAccountsAndPassowrd
or

name: MacOSUsersAccountsAndPassowords
or just

name: MacOSUsersAccounts

with the "doc" being:
doc: Users Accounts Information and hashed Password plist files

Actually this was already in the macos.yaml file as "MacOSUserPasswordHashesPlistFiles" same artifacts. I will remove it from this PR and address it in the next one, when cleaning the "plistfile" names

joachimmetz · 2018-10-22T14:10:41Z

data/macos.yaml

@@ -292,6 +313,17 @@ urls:
 - 'http://forensicswiki.org/wiki/Mac_OS_X'
 - 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Kernel_Extension'
 ---
+name: MacOSKnowledgeC
+doc: KnowledgeC User and Application usage database


KnowledgeC ? what does this stand for?

Maybe add some urls:
https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage

That DB is known as the "knowledgeC DB" that is why I left it as main name. Given it contains the user application usage, we may change it to either:

"MacOSKnowledgeUserApplicationUsage", although it sounds too long

just "MacOSUserApplicationUsage", better although I would have liked to keep the KnowledgeC in the name, But probably this is more useful.

About the URL, yes it is in the URLs note of the mac4n6 artifacts spreadsheet, but I just didn't parse that field in the conversion. I will add it.

ok, proper official name is "Duet Knowledge Base", changing the name to reflect this and moved "knowledgeC" and description to "doc:"

joachimmetz · 2018-10-22T14:12:06Z

data/macos.yaml

@@ -518,6 +550,26 @@ sources:
 labels: [System]
 supported_os: [Darwin]
 ---
+name: MacOSNotificationCenter
+doc: macOS NotificationCenter database


Instead of macOS I opt to use the more generic MacOS, unless it is specific to versions of MacOS that are named macOS ;)

Correct, it was a typo.

joachimmetz · 2018-12-14T10:54:26Z

@pstirparo if ready for re-review, please re-assign me as reviewer or add a comment with PTAL

joachimmetz

A couple of remaining nits and questions, but overall changes are good, thx for adding these

joachimmetz · 2018-12-14T16:48:22Z

data/macos.yaml

+    paths:
+    - '/var/db/diagnostics/*.tracev3'
+    - '/var/db/diagnostics/*/*.tracev3'
+    - '/var/db/uuidtext/*'


/var/db/uuidtext/* will only get you the files in /var/db/uuidtext/ you likely want /var/db/uuidtext/*/* as well?

Yes, sorry it was a typo. First level is only directories.

joachimmetz · 2018-12-14T16:48:45Z

data/macos.yaml

@@ -292,6 +313,17 @@ urls:
 - 'http://forensicswiki.org/wiki/Mac_OS_X'
 - 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#Kernel_Extension'
 ---
+name: MacOSKnowledgeC
+doc: KnowledgeC User and Application usage database


joachimmetz · 2018-12-14T16:49:33Z

data/macos.yaml

+labels: [Users, Logs]
+supported_os: [Darwin]
+urls:
+- 'https://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage'


seeing this is a single url please change to urls: ['https://...']

joachimmetz · 2018-12-14T16:49:46Z

data/macos.yaml

@@ -369,7 +401,7 @@ name: MacOSMailAccounts
 doc: Mail Accounts
 sources:
 - type: FILE
-  attributes: {paths: ['%%users.homedir%%/Library/Mail/V2/MailData/Accounts.plist']}
+  attributes: {paths: ['%%users.homedir%%/Library/Mail/V[0-9]/MailData/Accounts.plist']}


ack, SG; maybe add this to the doc string that V2, V3 and V5 have been observed?

joachimmetz · 2018-12-14T16:53:19Z

data/macos.yaml

@@ -11,6 +11,21 @@ urls:
 - 'http://forensicswiki.org/wiki/Mac_OS_X'
 - 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
 ---
+name: MacOSAppleUnifiedLog


please rename to "MacOSUnifiedLogging", since this is the name Apple is using.

https://developer.apple.com/videos/play/wwdc2016/721/
https://developer.apple.com/documentation/os/logging?language=occ

joachimmetz · 2018-12-14T16:54:27Z

data/macos.yaml

@@ -11,6 +11,21 @@ urls:
 - 'http://forensicswiki.org/wiki/Mac_OS_X'
 - 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'
 ---
+name: MacOSAppleUnifiedLog
+doc: Apple Unified Log


Unified Log => Unified Logging / Unified Logging and Activity Tracing / Unified Logging and Tracing System

changed to "Apple Unified Logging and Activity Tracing"

joachimmetz · 2018-12-14T16:55:51Z

data/macos.yaml

@@ -380,7 +416,7 @@ name: MacOSMailBackupTOC
 doc: Mail BackupTOC


I know this is not part of your changes but could you update this to "Mail Backup Table of Contents (TOC)", thx in advance.

joachimmetz

LGTM

pstirparo added 3 commits October 19, 2018 13:21

added several new macOS artifacts

9439eca

added several new macOS artifacts

e859ecb

added several new macOS artifacts

bab93fc

joachimmetz requested changes Oct 22, 2018

View reviewed changes

joachimmetz self-assigned this Oct 22, 2018

joachimmetz mentioned this pull request Dec 14, 2018

Added MacOS Unified logging definition #298

Closed

addressing joachimmetz comments

3393461

pstirparo assigned joachimmetz and unassigned joachimmetz Dec 14, 2018

pstirparo requested a review from joachimmetz December 14, 2018 14:15

joachimmetz requested changes Dec 14, 2018

View reviewed changes

fixing minor issues as suggested by joachimmetz

5c6dbb6

joachimmetz approved these changes Dec 17, 2018

View reviewed changes

joachimmetz merged commit 2168eaa into ForensicArtifacts:master Dec 17, 2018

pstirparo deleted the macos-new-artifacts branch December 17, 2018 09:51

		@@ -380,7 +416,7 @@ name: MacOSMailBackupTOC
		doc: Mail BackupTOC

Several macOS new artifacts #294

Several macOS new artifacts #294

Conversation

pstirparo commented Oct 19, 2018

codecov bot commented Oct 19, 2018 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joachimmetz commented Dec 14, 2018

joachimmetz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joachimmetz left a comment

Choose a reason for hiding this comment

codecov bot commented Oct 19, 2018 •

edited

Loading