Linux, macOS and Mobile Device Forensics

What it is

Not every case is a Windows PC. This page covers Linux memory, macOS logs and file system artifacts, and the acquisition and analysis of Android and iOS devices.

The exam checks that you know the right acquisition method for the platform, where the key artifacts live and why mobile devices are harder to examine.

How it works

Linux memory forensics

Memory holds running processes, network connections, loaded kernel modules and shell history that disk images miss. Acquire it first because it is volatile.

LiME (Linux Memory Extractor) is a loadable kernel module that dumps RAM, for example insmod lime.ko "path=/mnt/usb/mem.lime format=lime". AVML is another acquisition tool. Analysis uses Volatility, and the Linux kernel version must match the symbol or profile data used.

Viewing log messages in Mac

Since macOS 10.12 the Unified Logging system stores logs in a compact binary form (tracev3 files under /var/db/diagnostics). They are read with the log command or the Console app, not with a text editor.

• log show --last 1h displays recent entries.
• log show --predicate 'process == "sshd"' filters by process.
• log collect creates a .logarchive that can be read on another Mac.

Older text logs such as /var/log/system.log and ~/Library/Logs still hold some data.

APFS file system analysis with Biskus APFS Capture

APFS (Apple File System) is the default on modern Macs and iOS devices. A physical disk holds a container, and the container holds one or more volumes that share its free space.

Key features for an examiner: copy on write, snapshots, clones, native encryption and nanosecond timestamps. The container superblock carries the signature NXSB. A snapshot can preserve an earlier state of the volume, including files deleted later. The outline names Biskus APFS Capture, a third party tool for reading APFS volumes and exporting their metadata and files. Early versions could not open encrypted volumes, so check what the current version supports. The principle is to acquire the container, then examine each volume and its snapshots, while handling encryption keys.

Parsing metadata on Spotlight

Spotlight is the macOS search index. It records file attributes and content terms in an index store, and the .Spotlight-V100 folder at the root of a volume holds it. Even deleted or moved files may remain in the index.

The mdls command shows a file's Spotlight attributes, and mdfind searches the index. Useful attributes include kMDItemFSCreationDate, kMDItemLastUsedDate and kMDItemWhereFroms, the last of which records where a download came from.

Logical and physical acquisition of Android and iOS

Physical methods include bootloader or recovery based imaging, JTAG, ISP and chip off. Commercial tools include Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective and MSAB XRY. Modern phones use hardware backed encryption, so a physical image of a locked phone may be unreadable without the passcode.

Isolate the device first with airplane mode or a Faraday bag so remote wipe commands cannot reach it. Record its state and keep it charged.

Android and iOS forensic analysis

Most data is in SQLite databases and property list (plist) files.

SQLite database extraction

SQLite is a single file database that begins with the string SQLite format 3. Apps use it for messages, browser history and contacts.

Work on a copy, and copy the -wal and -journal files with it, because they hold recent changes. The sqlite3 tool or DB Browser for SQLite shows tables, for example .tables and .schema. Deleted rows may survive in free pages and the write ahead log, and specialist tools recover them.

Timestamps differ by platform: iOS and macOS often use seconds since 2001-01-01, Android commonly uses Unix time in milliseconds, and Chromium based browsers use microseconds since 1601. Convert them before building a timeline.

Challenges in mobile forensics

• Strong encryption and locked screens block access to data.
• Many devices, OS versions and updates make tools lag behind.
• Remote wipe, cloud sync and auto lock can change evidence.
• Data lives in apps, cloud accounts and wearables as well as the phone.
• Proprietary hardware and chip off need specialist skills and damage risk.

A worked example

A seized Android phone is placed in a Faraday bag and then connected to a forensic workstation. The examiner performs a logical extraction, hashes the output and then examines mmssms.db. A timestamp of 1729764000000 is Unix time in milliseconds, so the examiner divides by 1000 and converts it to UTC.

The messages show contact with a supplier. A later physical extraction recovers deleted rows from the same database.

How the exam asks about this

• "Which Linux tool is a kernel module for memory acquisition?" -> LiME.
• "Which command reads macOS Unified Logs?" -> log show.
• "Which mobile acquisition type cannot recover deleted data?" -> Logical acquisition.