MacOS Forensics

Scope of Work

To design a tool/package/script in python which will conduct the forensic activities in the following 2 scenarios:

Scenario 1: Tool / Script is pre-installed/configured in USB Drive

Scenario 2: Tool/Package is installed on the Macbook without requiring a system password

**We will have physical access to Macbook

Requirements:

A menu displaying various options that can be selected by users one after another to conduct the following activities.

• Create a complete backup of MAC OS as is.

• System information: System Name, Number of Users, MacOS Version, and mac configuration and save it in a txt file.

• Copy iCloud messages and save in pdf/HTML/CSV format + attachments

• Copy all images, videos, and other gallery items

• Copy all configured emails in .eml format

• Copy browser passwords: safari, chrome, firefox, etc

• Copy items from trash

• Copy data from critical locations ~/Library/Keychains and similar locations

Important Notes:

• All data will be stored in an external drive.

• Speed up the time to extraction by targeting and forensically acquiring files, folders, and user directories while avoiding known system files and other unnecessary data. Selectively acquire email, chat, address book, calendar, and other data on a per-user, per-volume basis.

• Thoroughly log data acquisitions and source device attributes throughout the collection process, and preserve valuable metadata by maintaining its association with the original file. Easily authenticate collected data through hashing.

Python Software Development Digital Forensics Forensic Consulting Mac OS

Project ID: #31299322

About the project