Inside the Core
The Macintosh Forensic Podcast


Follow Us

Categories

general
podcasts

Archives

2011
November
June

2010
December
July
June
March

2009
December
November
October
August
July
June
May

August 2017
S M T W T F S
     
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31

Syndication

iTunes Enhanced Mp3 Version

Disclaimer:
The Inside the Core podcast is provided for entertainment only. Any information, techniques, software or equipment that is discussed should be researched, tested and validated prior to use. This podcast is not a substitute for specialized training that is required for computer forensics. The topics of discussion and/or opinions are those of the host(s) and do not reflect the views of the hosts employers or former employers. Discussion of content, goods, or services provided by outside entities does not imply endorsement. Nothing in the podcast should be construed as an offer, solicitation or recommendation to buy or sell any specific products or training.

Inside the Core Episode 2 Episode 2 is uploaded! The sound quality is a bit better but still working on that. In this episode we cover: Defeating the Open Firmware password, Mobile Forensics World's iPhone Forensics panel discussion, the Plist of the Week and a few Mac websites.

You can send any comments or questions to:
Click here to send The MacDudes an e-mail


Episode 1 Show Notes (Download at: Show Notes)


GOLDEN RULE: Use OPTION key to boot first and confirm no Firmware Password

OFP: Prevents any other startup option other than "option" or "startup disk".

If OFP is active and you attempt alternative boot sequence, the system will default to  the normal “Startup Disk” and possible writes will be made.
-Dont want to make writes....

1. Boot with option key to confirm Open Firmware Password exist
2. To get around:
    A. Pull hard drive and image via write block (24 screws or less)

    B. Reconfigure the RAM:
        1) Shut down
        2) Disconnect power (if laptop remove battery)
        3) Remove stick or add stick of RAM to reconfigure
        4) Close up, connect battery/power
        5) Command+Option+P+R key all at once "Vulcan Death Grip"
        6) Listen for 3 Chimes-Indicates reset
        7) Restart and use Option key to check

NOTE: Time will be reset. The clock will possibly be off.
             Logs may be important.

Mobile Forensics World iPhone Forensics Panel

iPhone Panel:
-Ryan Kubasiak: Macosxforensics.com
-Jonathan Zdziarski : iPhone Forensics author
-Sean Morrissey :Dept. of Defense
-Andrew Hoag : Moderator

-Took questions from audience after moderated question session.

Different ways to get data:
Hardware/Software Suites:

Wolf: Good for unlocked phone, and if you unlock can use.

Cellebrite

Different Methods:
Raw Disk info: Jonathan Zdziarski and Sean Morrissey
                          -Concerns as to what is being changed from data 
                            standpoint

Dont forget about the iPhone backups on the Mac: a wealth of information

PList(s) of the Week(PLOW):

Plist: Registry like files but corruption of one file doesnʼt corrupt the entire system.

Application plists:

Quicktime:
Global: Library--> Preferences--> com.apple.quicktime.plist
-Shows Registered User and Registered Key
-Can indicate the key for verififcation of legal software

iWork (Mac Office Suite):
Global-->Library-->Preferences->
iWork08: com.apple.iwork08.plist
iWork09: com.apple.iwork09.plist


Google Gears:
Global--Library-->Preferences-> com.google.gears.plist 
User-->Library-->Preferences-> com.google.gmailnotifier.plist

Websites to Check Out:
Mac Shadows:  www.macshadows.com

Macenstein:  www.macenstein.com
Direct download: Inside_the_Core_Episode_2.m4a
Category:podcasts -- posted at: 4:22pm PDT