http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2014-10-13 16:33:51 - Apple Examiner RSS Feed : In this article, we cover the steps to create your own Fusion Drive Apple currently ships Fusion Drives in the iMac or Mac Mini as optional fast, large capacity storage options OS X 108 has the ability to create a home-brew Fusion Drive We discuss how-to and the specific care in creating your own http://www.secuobs.com/revue/news/539814.shtmlhttp://www.secuobs.com/revue/news/539814.shtml Secuobs.com : 2014-09-12 16:43:09 - Apple Examiner RSS Feed - Spotlight is a built-in indexing engine for OS X For it to operate fast, data must be stored on disk In this article, we discuss how Spotlight works, and where data can be found http://www.secuobs.com/revue/news/534685.shtmlhttp://www.secuobs.com/revue/news/534685.shtml Secuobs.com : 2014-08-14 16:51:29 - Apple Examiner RSS Feed - Reflector is an application that allows an iOS device to AirPlay to the Mac screen Many times, a native picture of data can mean more during a case than just the data itself This application will show a simulated iOS device even in white or black along with the screen of the iOS device you choose to display Simple screen captures of this can easily be added to a report We have a direct link from our site http://www.secuobs.com/revue/news/529925.shtmlhttp://www.secuobs.com/revue/news/529925.shtml Secuobs.com : 2014-05-30 21:22:06 - Apple Examiner RSS Feed - Awhile back, I wrote an article on creating your own Portable OS X Workstations , allowing any triage or analysis assigned person to boot, and view any Mac in a safe manner Times have changed It is time to revisit the concept, and create the best portable solution to protect, collect, and image ANY evidence we come across Let s create a current Portable Triage and Analysis Workstation http://www.secuobs.com/revue/news/516359.shtmlhttp://www.secuobs.com/revue/news/516359.shtml Secuobs.com : 2014-04-08 22:57:44 - Apple Examiner RSS Feed - We have a short blog entry on Boot Camp, Windows and Thunderbolt today with some linked articles to help out the situation http://www.secuobs.com/revue/news/507111.shtmlhttp://www.secuobs.com/revue/news/507111.shtml Secuobs.com : 2014-03-20 22:43:47 - Apple Examiner RSS Feed - SCOTTeVEST SeV has sent their Expedition jacket for a run with digital forensic gear This 37 pocket jacket was a pleasure to review, and we are very happy for the new sponsorship from SeV http://www.secuobs.com/revue/news/504078.shtmlhttp://www.secuobs.com/revue/news/504078.shtml Secuobs.com : 2014-01-23 23:16:18 - Apple Examiner RSS Feed - Extended attributes are extra information about a file or folder than can greatly change its function or appearance In this article, we explore how to view and interpret extended attributes for OS X http://www.secuobs.com/revue/news/493704.shtmlhttp://www.secuobs.com/revue/news/493704.shtml Secuobs.com : 2014-01-23 23:16:18 - Apple Examiner RSS Feed - The User Library Folder is one of the most important locations to find evidence for any case In this article, we show its location, and how different versions of OS X have allowed access to this important location http://www.secuobs.com/revue/news/493703.shtmlhttp://www.secuobs.com/revue/news/493703.shtml Secuobs.com : 2013-11-14 23:07:37 - Apple Examiner RSS Feed - In this article, Disk Layout and CoreStorage, we discuss the disk layouts one might encounter on a Macintosh Specifically, we explore Disk Utility, file systems, partition layouts, and CoreStorage Further, we examine the effect on imaging each type has and how best to collect data for analysis http://www.secuobs.com/revue/news/481096.shtmlhttp://www.secuobs.com/revue/news/481096.shtml Secuobs.com : 2013-08-19 22:07:03 - Apple Examiner RSS Feed - When collecting or analyzing data from OS X and iOS devices, it is important to consider the file system Evidence Containers article discusses file systems and evidence containers virtual disks http://www.secuobs.com/revue/news/463772.shtmlhttp://www.secuobs.com/revue/news/463772.shtml Secuobs.com : 2013-06-03 18:48:32 - Apple Examiner RSS Feed - We have updated the list of files and folders to focus on for specific case evidence This was previously named Initial Data Gathering http://www.secuobs.com/revue/news/449070.shtmlhttp://www.secuobs.com/revue/news/449070.shtml Secuobs.com : 2013-05-24 22:43:36 - Apple Examiner RSS Feed - We have written an article on using Reflector for iOS based casework This application allows an analyst to take advantage of AirPlay and display native views of iOS data http://www.secuobs.com/revue/news/447635.shtmlhttp://www.secuobs.com/revue/news/447635.shtml Secuobs.com : 2013-05-02 02:53:25 - Apple Examiner RSS Feed - We have posted a quick reference to OS X and its abilities to utilize other file systems This reference also correlates date stamps from HFS to other file systems http://www.secuobs.com/revue/news/443041.shtmlhttp://www.secuobs.com/revue/news/443041.shtml Secuobs.com : 2013-03-06 19:46:31 - Apple Examiner RSS Feed - In this article, we offer rationale for using Macs for evidence imaging and triage Hardware and software is explored as well as a few common situations where this can be used We build both a field and laboratory, low-cost, solution to image, view, and work with all types of evidence http://www.secuobs.com/revue/news/431835.shtmlhttp://www.secuobs.com/revue/news/431835.shtml Secuobs.com : 2013-02-19 22:53:07 - Apple Examiner RSS Feed - We have written an article on the current feature in Safari called Top Sites This feature creates PNG files as a part of this function The pictures can be used as a part of the digital forensic story of a Mac This article contains the header for webpage preview files to assist in your file carving http://www.secuobs.com/revue/news/428656.shtmlhttp://www.secuobs.com/revue/news/428656.shtml Secuobs.com : 2013-01-10 19:48:29 - Apple Examiner RSS Feed - Our Mac acquisition page has been updated to discuss Thunderbolt, current Firmware Password methods, and other solutions http://www.secuobs.com/revue/news/421026.shtmlhttp://www.secuobs.com/revue/news/421026.shtml Secuobs.com : 2012-10-29 13:58:11 - Apple Examiner RSS Feed - Eli Rosenblatt has written an article detailing artifacts from OS X clipboard managers http://www.secuobs.com/revue/news/408345.shtmlhttp://www.secuobs.com/revue/news/408345.shtml Secuobs.com : 2012-08-30 15:52:27 - Apple Examiner RSS Feed - We have posted an article on how to use the new VMWare Fusion v5 with more than 8GB of RAM This article shows FTK v4 running successfully in a virtualized environment http://www.secuobs.com/revue/news/396747.shtmlhttp://www.secuobs.com/revue/news/396747.shtml Secuobs.com : 2012-08-27 21:33:20 - Apple Examiner RSS Feed - n part 4, we look at the directories that are well hidden from view and their meanings BlackLight and fileXray are used to reveal content http://www.secuobs.com/revue/news/396091.shtmlhttp://www.secuobs.com/revue/news/396091.shtml Secuobs.com : 2012-07-19 14:32:46 - Apple Examiner RSS Feed - We have added a page listing the location of iOS paring files for each operating system http://www.secuobs.com/revue/news/388381.shtmlhttp://www.secuobs.com/revue/news/388381.shtml Secuobs.com : 2012-07-11 15:37:46 - Apple Examiner RSS Feed - In part 3, we look at the entries in the User Home folder of a standard 107 Lion installation, as well as a few non-standard yet popular artifacts http://www.secuobs.com/revue/news/386610.shtmlhttp://www.secuobs.com/revue/news/386610.shtml Secuobs.com : 2012-06-25 20:35:13 - Apple Examiner RSS Feed - In part 2, we look at several locations available from the Root level that are likely hidden from GUI view of the user yet contain a wealth of information for any analysis Part 3 will look into the User's Home folder and Part 4 will discuss locations not seen from either the GUI or Terminal http://www.secuobs.com/revue/news/383649.shtmlhttp://www.secuobs.com/revue/news/383649.shtml Secuobs.com : 2012-06-12 04:36:35 - Apple Examiner RSS Feed - In this article, we examine the new feature of Elcomsoft s latest edition of Phone Password Breaker and download an iOS device backup from Apple iCloud storage, and further analyze the content http://www.secuobs.com/revue/news/380928.shtmlhttp://www.secuobs.com/revue/news/380928.shtml Secuobs.com : 2012-06-12 04:36:35 - Apple Examiner RSS Feed - In part 1 of this series, we begin to examine the file and folder structure of the OS X 107 installation We look at the structure from the Finder GUI , and the Terminal Command Line Later we look into the User s Home folder and finally conclude the series with a view from analysis software showing data not seen from the Finder or Terminal http://www.secuobs.com/revue/news/380927.shtmlhttp://www.secuobs.com/revue/news/380927.shtml Secuobs.com : 2012-02-19 03:05:21 - Apple Examiner RSS Feed - We have added a link in our Mac Software Section under Decryption to HashCat HashCat is advanced password recovery decryption software that uses the CPU and GPU capabilities of a Mac or PC to crack hashes http://www.secuobs.com/revue/news/358664.shtmlhttp://www.secuobs.com/revue/news/358664.shtml Secuobs.com : 2012-02-03 16:50:06 - Apple Examiner RSS Feed - Sean Cavanaugh has written an in-depth article on the usage of the free, GUI based, iOS imaging utility Lantern Lite from Katana Forensics http://www.secuobs.com/revue/news/355799.shtmlhttp://www.secuobs.com/revue/news/355799.shtml Secuobs.com : 2011-12-05 07:53:02 - Apple Examiner RSS Feed - We have written an article on the Apple virtual disk format, DMG, and how to convert between compressed and uncompressed when needed http://www.secuobs.com/revue/news/345305.shtmlhttp://www.secuobs.com/revue/news/345305.shtml Secuobs.com : 2011-11-28 05:16:39 - Apple Examiner RSS Feed - We have written an article about case reports and specifically the PDF format We use the application PDFPen Pro to look at embedded data, redact data, and edit the PDF files to create great looking reports at case completion http://www.secuobs.com/revue/news/344022.shtmlhttp://www.secuobs.com/revue/news/344022.shtml Secuobs.com : 2011-09-24 23:13:47 - Apple Examiner RSS Feed - Now is a great time to re-visit our Apple Examiner Store Take a look at the new items LOFCE has added for embroidery with our logo Show of your Apple side with more than just the Apple logo Don't forget to use our Amazon Store when shopping as well Thanks for you support in keeping the site successful http://www.secuobs.com/revue/news/330902.shtmlhttp://www.secuobs.com/revue/news/330902.shtml Secuobs.com : 2011-09-13 21:06:11 - Apple Examiner RSS Feed - Sean Cavanaugh John Jackson have written an excellent article on locating multi-linked files in Time Machine Backups using a Windows based environment We have added it to our Reading Resources http://www.secuobs.com/revue/news/328630.shtmlhttp://www.secuobs.com/revue/news/328630.shtml Secuobs.com : 2011-08-14 05:50:52 - Apple Examiner RSS Feed - F-Response TACTICAL 107 Lion we have added a new article about using F-Response TACTICAL for live response to Lion based Macintosh computers that have FileVault2 full disk encryption enabled http://www.secuobs.com/revue/news/322972.shtmlhttp://www.secuobs.com/revue/news/322972.shtml Secuobs.com : 2011-06-23 05:36:23 - Apple Examiner RSS Feed - iOS Device Analysis Tools - we have created a consolidated page with iOS device analysis tools available, classified by software, hardware and miscellaneous apps available http://www.secuobs.com/revue/news/313025.shtmlhttp://www.secuobs.com/revue/news/313025.shtml Secuobs.com : 2011-06-23 05:36:23 - Apple Examiner RSS Feed - iPhone and iOS Forensics by Andrew Hoog and Katie Strzempka - Amazon has just emailed me a tentative shipping date of June 30th for this excellent resource and well written book for iOS digital forensics http://www.secuobs.com/revue/news/313024.shtmlhttp://www.secuobs.com/revue/news/313024.shtml Secuobs.com : 2011-02-21 22:34:49 - Apple Examiner RSS Feed - We have written an article on creating your own Portable OS X Workstation to boot OS X from a USB, Firewire or eSATA connected drive This offers the ability to image, and conduct field forensics on any Mac with the correct installation This will even get you into that pesky MB Air Read more here to get our tips http://www.secuobs.com/revue/news/286686.shtmlhttp://www.secuobs.com/revue/news/286686.shtml Secuobs.com : 2011-02-11 06:55:51 - Apple Examiner RSS Feed - GPSForensics has a unique article on acquiring the data from an iPhone with the help of a great utility from Erica Sadun called MDHelper http://www.secuobs.com/revue/news/284549.shtmlhttp://www.secuobs.com/revue/news/284549.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - Apple Technical Docs have been updated with links to documents that relate to digital analysis and incident response http://www.secuobs.com/revue/news/284107.shtmlhttp://www.secuobs.com/revue/news/284107.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - Safari Quick Notes - A quick reference to the places of interest when examining Safari v5 and v4 http://www.secuobs.com/revue/news/284106.shtmlhttp://www.secuobs.com/revue/news/284106.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - FTK Imager for Mac GUI - this is the FTK Imager by AccessData with a Graphical User Interface added to it It is in beta now Please read the included notes before using I welcome your feedback http://www.secuobs.com/revue/news/284105.shtmlhttp://www.secuobs.com/revue/news/284105.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - BlackLight from BlackBag Technologies - we have written an article about the key features of the new digital forensic suite from BlackBag Technologies and how it can make your laboratory much more productive when analyzing Apple products http://www.secuobs.com/revue/news/284104.shtmlhttp://www.secuobs.com/revue/news/284104.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - iOS Airplane Mode - we have posted an article about the nuances of iOS Airplane Mode and how it doesn t always isolate the radios of the devices from the network http://www.secuobs.com/revue/news/284103.shtmlhttp://www.secuobs.com/revue/news/284103.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - Bluetooth Analysis - Bluetooth Explorer is an application included with Apple s Developer Tools We have an article showing how you might be able to use it during your analysis http://www.secuobs.com/revue/news/284102.shtmlhttp://www.secuobs.com/revue/news/284102.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - iPhone Carrier Select - the iPhone has the ability to automatically choose the carrier for voice and data services We take a look at the selection ability in this article http://www.secuobs.com/revue/news/284101.shtmlhttp://www.secuobs.com/revue/news/284101.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - Sean Cavanaugh has written as article on using Safari to view PLIST files The article is written from the perspective of Safari on Windows which shows how to view PLIST files without installing any other tools http://www.secuobs.com/revue/news/284100.shtmlhttp://www.secuobs.com/revue/news/284100.shtml Secuobs.com : 2011-02-09 22:03:08 - Apple Examiner RSS Feed - BlackBag Technologies has posted on their blog a great new feature of 1065 and later of USB device logging We have added it to our new page, USB Entries on OS X where we list other areas of interest for media entries as well http://www.secuobs.com/revue/news/284099.shtmlhttp://www.secuobs.com/revue/news/284099.shtml