dfm covers
 
 

Mac Memory Forensics

Written by DFMag


Mac Memory Forensics

WeChat Analysis on a live system, Kelvin Wong investigates...

Rapid growth of the use of Mac OS X requires forensics researchers to analyse devices such as iPad, iPhone and Mac in depth. OS X forensics really started with Jonathan Zdziarski in 2008, but soon became widespread with most of the research and training focused on file system analysis. There are a number of tools available to analyse OS X, e.g. Volatility, Volafox, Memoryze for Mac, Mac Memory Reader, MacLockPick and Rekall, however the ability to analyse Mac memory will be complex and disconcerting to the novice. We have attempted in this article to demonstrate a fast track method of Mac memory forensic analysis by studying the evidence of a very popular Chinese social networking application ‘WeChat’. Memory Forensics is the art of analyzing computer memory (RAM) to solve digital crimes’ defined by Michael Hale Ligh, Andrew Case and, Jamie Levy. Computer forensics science is not only considered a science but an art. With the global use of smart phones and the Internet, a great number of individuals now communicate with their friends using some form of mobile social networking application, e.g. ‘Facebook, Whatsapp, SnapChat etc.’ In China and surrounding countries, especially Hong Kong, the most famous and commonly used chatting platform is WeChat. These applications provide not only a smart phone but also a desktop version. Therefore, we cannot ignore any possibility of evidence in either the file system or memory from a desktop machine. Memory analysis is an important intersection, therefore in this article we will examine the memory dump from a Mac machine, by acquisition, process analysis and data collection through an example of running WeChat on OS X.




Find out more - subscribe to DFM today and read the full article. Or if you're a subscriber, login and read the article online.


 
Please make cache directory writable.
 

Submit an Article

Call for Articles

We are keen to publish new articles from all aspects of digital forensics. Click to contact us with your completed article or article ideas.

Featured Book

Learning iOS Forensics

A practical hands-on guide to acquire and analyse iOS devices with the latest forensic techniques and tools.

Meet the Authors

Mark Osborne

Mark Osborne is the author of 'How To Cheat at Managing Information Security'

 

Coming up in the Next issue of Digital Forensics Magazine

Coming up in Issue 39 on sale from February 2019:


Making Sense of Digital Forensic International Standards

To many the complexity of Standards, their numbering and obscure contents fail to make practical sense and confuse the entry points for effective use. A roadmap is provided in this paper for Standard information access and optimal use. Read More »

Evidentiary Challenges: Social media, the Dark Web, and Admissibility

This article takes a look at two categories of remote evidence: social media, and the dark web. We will also examine two interesting cases: The Target store credit card breach; and the civil case of Fero v Excellus Health Plan, Inc. Read More »

Subscribe today


Vehicle Data Forensics on Unsupported Systems

The article will help readers understand how to approach a vehicle from a digital forensics’ perspective, it will cover a range of infotainment units from popular manufacturers, data extraction methods and examples of data types found which may be considered intelligence and or used as digital evidence. Read More »

Every Issue
Plus the usual Competition, Book Reviews, 360, IRQ, Legal

Click here to read more about the next issue