Membership

MacOS Anti-Forensics (W37)

Examine anti-forensic techniques affecting macOS evidence. Study how investigative traces can be changed and what those limitations mean for analysis. This is an earlier course edition; examples reflect the tools and versions used when it was recorded.

Instructor · Cordny Nederkoorn

Modules:
4
Lessons:
69

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Describe categories of anti-forensic techniques.
  • Examine how macOS evidence can be altered or concealed.
  • Evaluate the effect of anti-forensics on investigative conclusions.

Prerequisites

You should be familiar with: computer forensic investigation concepts: imaging, hashing working on a MacOS: finding files computer data, image and video files (where to find logs on MacOS, different image files, etc.) installing computer-based software from a website Basic programming skills (desired but not essential) Equipment and software: To participate in the course you'll need: A macBook Pro with min. MacOS 10.11.6 (El Capitan); 2,7 GHz Intel Core i5; 8 GB 1867 MHz DDR3 Good internet connection to download tools on the fly

Module 2

Module 1

  1. 1. (W37M05) Introduction to Module 1

  2. 2. (W37M06) Introduction to macOS anti-forensics

  3. 3. (W37M07) Categories of macOS anti-forensics

  4. 4. (W37M08) macOS components critical for anti-forensics

  5. 5. (W37M09) Category - Data Hiding

  6. 6. (W37M10) Category - Artefact wiping

  7. 7. (W37M11) Category - Trail Obfuscation

  8. 8. (W37M12) Category - Attacks Against Forensics

  9. 9. (W37M13) Category - Case Study - the Marble framework

  10. 10. (W37M14) Privacy protection in Safari, Part 1

  11. 11. (W37M15) Privacy protection in Safari, Part 2

Assessments

Assignment Required

(W37A02) Module 1 Assignments

Module 3

Module 2

  1. 1. (W37M16) Tooling introduction - data hiding

  2. 2. (W37M17) Data hiding - SilentEye walkthrough

  3. 3. (W37M18) Data hiding - SilentEye Overview

  4. 4. (W37M19) Data Hiding - SilentEye - Pros and Cons

  5. 5. (W37M20) Data hiding experiments: SilentEye - lab setup

  6. 6. (W37M21) SilentEye - Steganography without encrytpion

  7. 7. (W37M22) SilentEye: Steganography with encryption

  8. 8. (W37M23) SilentEye: File in an image steganography without encryption

  9. 9. (W37M24) SilentEye: File in an image steganography with encryption

  10. 10. (W37M25) Data hiding: Intro to Filevault

  11. 11. (W37M26) Data hiding: enable Filevault

  12. 12. (W37M27) Data hiding: disable Filevault

  13. 13. (W37M28) Datahiding: Filevault Pros and Cons

  14. 14. (W37M29) What is artefact wiping?

  15. 15. (W37M30) Artefact wiping with Disk Utility

  16. 16. (W37M31) Experiments with Disk Utility

  17. 17. (W37M32) Diskutulity Pros and Cons

  18. 18. (W37M33) Intro to Disk Utility debug model

  19. 19. (W37M34) Experiments with Disk Utility Debug

  20. 20. (W37M35) Disk Utility Debug Pros and Cons

  21. 21. (W37M36) What is trail obfuscation?

  22. 22. (W37M37) Trail obfuscation experiments

  23. 23. (W37M38) Trail obfuscation - experiment

  24. 24. (W37M39) Tunnelblick and obfsproxy - Lab setup

  25. 25. (W37M40) Tunnelblick walkthrough

  26. 26. (W37M41) Trail obfuscation - Get the IP address

  27. 27. (W37M42) Tunnelblick - Pros and Cons

  28. 28. (W37M43) Attacks against forensics - introduction

  29. 29. (W37M44) What is counterforensics?

  30. 30. (W37M45) What is CyberChef?

  31. 31. (W37M46) Lab Setup - CyberChef

  32. 32. (W37M48) CyberChef walkthrough

  33. 33. (W37M49) CyberChef operation DateTime

  34. 34. (W37M50) CyberChef operation zip/unzip

  35. 35. (W37M51) CyberChef operation: hashing

  36. 36. (W37M52) How to work with a recipe

  37. 37. (W37M53) CyberChef - Morse Code

  38. 38. (W37M54) Cyberchef: dataformat

  39. 39. (W37M55) CyberChef - pros and cons

  40. 40. (W37M47) Information on module 2 examination

  41. 41. (W37M00) Usecases - Addendum

Assessments

Assignment Required

(W37A03) Module 2 Assignments - Theory

Assignment Required

(W37A04) Module 2 Assignments - Practice

Module 4

Module 3

  1. 1. (W37M00) Module 3 Introduction

  2. 2. (W37M56) Forensics vs Anti-Forensics Arms Race

  3. 3. (W37M57) Anti-Forensics - macOS vs Windows

  4. 4. (W37M58) Windows Anti-Forensic Tools - BitLocker

  5. 5. (W37M59) Case Study - IoT

  6. 6. (W37M60) Case study - fileless malware

  7. 7. (W37M61) Effectiveness of Anti-Forensics Software

  8. 8. (W37M62) Case Study - Azure Sphere

  9. 9. (W37M63) Case Study - ITP2

  10. 10. (W37M64) Case-Study - Celeb Gate

  11. 11. (W37M65) iOS and macOS - future plans

  12. 12. (W37M00) Addendum: FAQ - Project Marzipan

Assessments

Assignment Required

(W37A05) Module 3 Exercises

Module 5

Final Exam

Lessons will appear here after course content is added.

Assessments

Assignment Required

(W37A06) Final Exam

Course access

Unlock MacOS Anti-Forensics (W37).

Enter your email. We’ll send a sign-in code here without taking you away from this course.