macOS, Cloud Evidence and Dark Web Analysis

What it is

This page covers three analysis areas beyond a Windows disk: Apple macOS systems, evidence held in cloud services, and activity that touches the dark web. Each has its own artifact set and its own risks.

The exam asks where macOS keeps user activity, which cloud logs answer a question, what the dark web is, and which traces Tor Browser leaves on Windows.

How it works

Collecting and analyzing macOS artifacts

macOS uses APFS and keeps settings in property list (plist) files. Important sources:

Acquire an image through a supported method, check whether FileVault is on, and process the data with a tool that understands APFS. The Mac's own clock and time zone settings are noted at the start.

Analyzing macOS user activities

Combine these to answer what the user opened, from where it came and when. A downloaded file with a quarantine record and a later launch is a strong sequence.

Cloud digital evidence analysis

Cloud evidence mainly consists of logs, snapshots and account data. Match the question to the source.

Check the time zone (usually UTC), confirm the log has not been turned off or cleared, and correlate with on premises logs. Work from preserved exports and keep hashes.

Dark web forensics

The surface web is indexed by search engines. The deep web is not indexed, such as accounts and databases. The dark web is a part of the deep web that needs special software, such as Tor, to reach. Tor routes traffic through relays using layers of encryption (onion routing), and onion services have .onion addresses.

Dark web forensics tries to link activity to a person despite anonymity, using what remains on the endpoint, in network records, and in seized servers and payment trails.

Information found on the dark web

• stolen credentials, card data and leaked databases
• illegal marketplaces for drugs, weapons and counterfeit documents
• malware, exploit kits and attack services for sale
• forums where attacks and fraud are planned
• extortion and ransomware leak sites

Such findings are leads and threat intelligence, and need verification before acting.

Safety precautions

Exploring the dark web exposes the investigator to malware, illegal content and tracking.

• Get legal and management approval, and follow policy.
• Use an isolated virtual machine or a dedicated system, with no personal accounts.
• Use a hardened, privacy focused environment such as Tails, or a clean disposable VM.
• Never download or open unknown files, and do not enable scripts needlessly.
• Do not buy anything or interact in ways that break the law.
• Document every visit, and capture evidence with screenshots and hashes.

Tor Browser artifacts on Windows

Tor Browser is designed to leave little on disk, but traces remain on the host.

Tor Browser does not keep normal browsing history, so the execution evidence matters most. Deleted installation folders still leave prefetch and registry traces.

A worked example

A Windows workstation is suspected of reaching a leak site. There is no browser history. Prefetch shows TOR.EXE ran five times in two days, and UserAssist agrees.

The investigator finds the installer in the downloads folder and Tor related connections in a captured memory image. The report states that Tor was used, and does not claim the content visited.

How the exam asks about this

• "Which Prefetch file indicates Tor Browser was run?" → TOR.EXE prefetch.
• "Which macOS database records downloaded file origins?" → The quarantine events database.
• "What kind of log shows API activity in a cloud account?" → The provider's audit log, such as CloudTrail.