Cyber Security,Forensics, Incident Response,Mac Forensics, Windows Forensics, Digital Forensics

MAC Timeline Analysis

6/5/2017

In this article, I am going to talk about basic forensic time analysis procedure:

Identify the partition in an image using mmld <filename> command. Don’t forget to make a note of start sector of the partition.
Identify the type of filesystem is has using fsstat -o <start sector> command.
List all the files including deleted files by name using this command :fls -o <offset> -f <filesystem> -m “/“ -r <filename> > flsbody
What if the deleted file does not have a name- use this command ils -o <offset> -f <filesystem> -m <filename> > ilsbody

6/5/2017

uptime - it tell you how long the system has been up. In case of system compromise, it’s a handy command.
uname - a : OS, Filesystem information
ifconfig - network configuration, look for IP address and is it in promisc mode or not.
netstat -at : Shows TCP Connection
lsof: List open files and gives you open network
lsof +L : list recently deleted files.