{"id":807,"date":"2019-05-27T12:18:43","date_gmt":"2019-05-27T10:18:43","guid":{"rendered":"http:\/\/www.forensee.cz\/?p=807"},"modified":"2021-03-16T17:06:16","modified_gmt":"2021-03-16T16:06:16","slug":"zaklady-forenzni-analyzy-na-macos","status":"publish","type":"post","link":"https:\/\/www.forensee.cz\/en\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/","title":{"rendered":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na macOS"},"content":{"rendered":"[et_pb_section fb_built=“1″ _builder_version=“3.22″][et_pb_row _builder_version=“4.0.4″ background_size=“initial“ background_position=“top_left“ background_repeat=“repeat“ width=“100%“][et_pb_column type=“4_4″ _builder_version=“3.25″ custom_padding=“|||“ custom_padding__hover=“|||“][et_pb_text _builder_version=“4.9.2″ background_size=“initial“ background_position=“top_left“ background_repeat=“repeat“ hover_enabled=“0″ text_orientation=“justified“ sticky_enabled=“0″]\n

St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z\u00a0nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost a ochranu dat sv\u00fdch z\u00e1kazn\u00edk\u016f, a tak se zaji\u0161\u0165ov\u00e1n\u00ed a zkouman\u00ed dat z t\u011bchto za\u0159\u00edzen\u00ed st\u00e1v\u00e1 st\u00e1le slo\u017eit\u011bj\u0161\u00ed. Uk\u00e1zkov\u00fd p\u0159\u00edklad jejich u\u017e star\u0161\u00ed novinky je \u010dip T2, kter\u00fd seskupuje n\u011bkter\u00e9 \u0159adi\u010de, kter\u00e9 se nach\u00e1zely v\u00a0po\u010d\u00edta\u010di na r\u016fzn\u00fdch m\u00edstech. Stoj\u00ed tak nad cel\u00fdm syst\u00e9mem a t\u00edm umo\u017e\u0148uje lep\u0161\u00ed zabezpe\u010den\u00ed \u2013 slou\u017e\u00ed jako z\u00e1klad pro \u0161ifrov\u00e1n\u00ed cel\u00e9ho \u00falo\u017ei\u0161t\u011b a zabezpe\u010den\u00e9ho spou\u0161t\u011bn\u00ed. I p\u0159esto u\u017e dnes existuj\u00ed mo\u017enosti, jak tento typ za\u0159\u00edzen\u00ed zajistit. My se v\u00a0tomto \u010dl\u00e1nku pokus\u00edme pod\u00edvat na \u00fapln\u00e9 z\u00e1klady zaji\u0161\u0165ov\u00e1n\u00ed dat z po\u010d\u00edta\u010d\u016f od firmy Apple.\u00a0<\/p>\n

Po p\u0159\u00edchodu k\u00a0vypnut\u00e9mu a zaheslovan\u00e9mu po\u010d\u00edta\u010di, m\u016f\u017eeme postupovat klasick\u00fdm zp\u016fsobem. P\u0159i \u0161t\u011bst\u00ed se dnes je\u0161t\u011b m\u016f\u017eeme dostat ke star\u0161\u00edm MacBook\u016fm, kter\u00e9 jsou vybaveny vym\u011bniteln\u00fdm diskem. Star\u0161\u00ed modely Unibody MacBooku Pro (2008-2012) v\u011bt\u0161inou obsahuj\u00ed klasick\u00fd SATA 2,5\u201c disk, ze kter\u00e9ho je mo\u017en\u00e9 pak ud\u011blat kopii pomoc\u00ed blok\u00e1toru nebo duplik\u00e1toru. Pozd\u011bj\u0161\u00ed MacBooky Pro s\u00a0retina displejem (2012-2015) maj\u00ed m\u00edsto klasick\u00fdch disk\u016f flash pam\u011b\u0165, kter\u00e1 se jev\u00ed jako SSD s\u00a0rozhran\u00edm M.2, ale z\u00a0v\u00fdroby tomu tak nen\u00ed. Je nutn\u00e9 pou\u017e\u00edt redukci pr\u00e1v\u011b na M.2, aby se disk dal bez probl\u00e9mu p\u0159ipojit.\u00a0<\/span><\/p>\n

Posledn\u00ed modely v\u0161ech Macbook\u016f (2015 – dodnes) maj\u00ed pam\u011b\u0165ov\u00fd \u010dip p\u0159ip\u00e1jen\u00fd na desce, proto jej nen\u00ed mo\u017en\u00e9 jednodu\u0161e demontovat a zajistit data b\u011b\u017en\u00fdm zp\u016fsobem. Ostatn\u00ed modely stoln\u00edch po\u010d\u00edta\u010d\u016f Apple z\u00a0dne\u0161n\u00ed doby (iMac, Mac mini) jsou na tom obdobn\u011b. V\u00fdjimkou je Mac Pro, kde lze fyzicky disky vyjmout. Nejjednodu\u0161\u0161\u00ed zp\u016fsob, jak z\u00a0vypnut\u00e9ho po\u010d\u00edta\u010de data zajistit je p\u0159es tzv. Target mode, kter\u00fd z\u00a0po\u010d\u00edta\u010de ud\u011bl\u00e1 extern\u00ed disk a data tak lze st\u00e1hnout. Do Target modu po\u010d\u00edta\u010d dostaneme zap\u00ednac\u00edm tla\u010d\u00edtkem a stisknut\u00edm kl\u00e1vesy T. Probl\u00e9m nast\u00e1v\u00e1, kdy\u017e za\u0159\u00edzen\u00ed v\u00a0Target modu p\u0159ipoj\u00edte k\u00a0po\u010d\u00edta\u010di, kter\u00fd neum\u00ed \u010d\u00edst souborov\u00fd syst\u00e9m Applu. Star\u0161\u00ed souborov\u00fd syst\u00e9m HFS+, v\u00a0macOS naz\u00fdvan\u00fd Mac OS Extended, vyu\u017e\u00edval Apple do konce roku 2017. S\u00a0t\u00edm v\u011bt\u0161ina SW a HW dnes nem\u00e1 probl\u00e9m, proto m\u016f\u017eeme takov\u00fd disk zajistit i pomoc\u00ed freeware n\u00e1stroje FTK Imager, nebo p\u0159es forenzn\u00ed duplik\u00e1tor. Velkou p\u0159ek\u00e1\u017ekou p\u0159i zaji\u0161\u0165ov\u00e1n\u00ed m\u016f\u017ee b\u00fdt nov\u00fd souborov\u00fd syst\u00e9m Apple File System (APFS), se kter\u00fdm si v\u011bt\u0161ina n\u00e1stroj\u016f dodnes neum\u00ed poradit. Nejjednodu\u0161\u0161\u00edm p\u0159\u00edkladem, jak po\u010d\u00edta\u010d s\u00a0APFS zajistit v\u00a0Target modu, je s\u00a0vyu\u017eit\u00edm po\u010d\u00edta\u010de b\u011b\u017e\u00edc\u00edm na macOS. Ten toti\u017e za\u0159\u00edzen\u00ed bez probl\u00e9mu rozpozn\u00e1, v\u00a0p\u0159\u00edpad\u011b vyu\u017eit\u00ed \u0161ifrov\u00e1n\u00ed FileVault 2 (p\u0159edchoz\u00ed generace \u0161ifrovala jen domovskou slo\u017eku) je mo\u017en\u00e9 zadat heslo a tak disk okam\u017eit\u011b proch\u00e1zet. Vytvo\u0159en\u00ed image ve form\u00e1tu .dd je mo\u017en\u00e9 p\u0159es jednoduch\u00fd p\u0159\u00edkaz v\u00a0Termin\u00e1lu. Image lze vytvo\u0159it i bez zad\u00e1n\u00ed hesla.\u00a0<\/span><\/p>\n

Pro vytvo\u0159en\u00ed obrazu disku ve form\u00e1tu .dd je pot\u0159eba nejd\u0159\u00edve ov\u011b\u0159it, kter\u00fd disk hled\u00e1me. K\u00a0tomu napom\u016f\u017ee p\u0159\u00edkaz:<\/span><\/p>\n

$ diskutil list<\/strong><\/p>\n

V\u00a0p\u0159\u00edpad\u011b, \u017ee jsme disk p\u0159ipojili de\u0161ifrovan\u00fd, nebo jsme zadali heslo, je t\u0159eba disk softwarov\u011b vysunout. V\u00a0opa\u010dn\u00e9m p\u0159\u00edpad\u011b tento p\u0159\u00edkaz m\u016f\u017eeme ignorovat.<\/span><\/p>\n

$ diskutil unmountDisk \/dev\/diskX<\/strong>\u00a0\/\/X pouze vym\u011bn\u00edme za \u010d\u00edslo vybran\u00e9ho disku<\/span><\/p>\n

Te\u010f u\u017e pouze s\u00a0p\u0159\u00edkazem dd vytvo\u0159\u00edme image po\u017eadovan\u00e9ho disku. V\u00a0p\u0159\u00edkazu zad\u00e1me za\u00a0if=\u00a0zdrojov\u00fd disk a za\u00a0of=\u00a0cestu, kam chceme image ulo\u017eit. \u010c\u00edslo ba\u00a0bs=\u00a0zna\u010d\u00ed velikost bloku (nen\u00ed nutn\u00e9 m\u00edt v\u00a0p\u0159\u00edkazu v\u016fbec).<\/span><\/p>\n

$ sudo dd if=\/dev\/diskX of=\/Volumes\/image.dd bs=1m<\/strong><\/p>\n

Pokud chceme kontrolovat pr\u016fb\u011bh vytv\u00e1\u0159en\u00ed image, kl\u00e1vesovou zkratkou Ctrl + Shift + T zjist\u00edme aktu\u00e1ln\u00ed stav.\u00a0<\/span><\/p>\n

Jednou z\u00a0dal\u0161\u00edch mo\u017enost\u00ed, jak vytvo\u0159it image z\u00a0po\u010d\u00edta\u010d\u016f Apple, je vyu\u017eit\u00ed speci\u00e1ln\u00edch n\u00e1stroj\u016f. Nejb\u011b\u017en\u011bj\u0161\u00edm je \u0159e\u0161en\u00ed MacQuisition od firmy BlackBagTech, dal\u0161\u00ed mo\u017enost\u00ed je RECON Imager od SUMURI. Oba produkty funguj\u00ed obdobn\u00fdm zp\u016fsobem, dok\u00e1\u017e\u00ed pracovat s\u00a0APFS, FileVault 2, Fusion Drive a zvl\u00e1dnou zajistit data RAM i bez zad\u00e1n\u00ed hesla. Dokonce se po \u010derstv\u00fdch updatech zvl\u00e1dnou vypo\u0159\u00e1dat i s\u00a0\u010dipem T2. To v\u00a0praxi znamen\u00e1, \u017ee lze zajistit za\u0159\u00edzen\u00ed bez probl\u00e9m\u016f p\u0159es Target mode z\u00a0jin\u00e9ho za\u0159\u00edzen\u00ed Apple, v\u00a0opa\u010dn\u00e9m p\u0159\u00edpad\u011b je nutn\u00e9 zn\u00e1t administr\u00e1torsk\u00e9 \u00fadaje a vypnout Secure Boot.\u00a0<\/span><\/p>\n

U dan\u00fdch \u0159e\u0161en\u00ed je mo\u017en\u00e9 zajistit data tak, aby \u0161la zpracovat v\u00a0jak\u00e9mkoli forenzn\u00edm n\u00e1stroji \u2013 na logick\u00e9 \u00farovni. Souborov\u00fd syst\u00e9m APFS u\u017e \u010d\u00e1ste\u010dn\u011b zvl\u00e1d\u00e1 i EnCase nebo Magnet AXIOM. Nejlep\u0161\u00ed je samoz\u0159ejm\u011b pracovat se softwarem od firmy, kter\u00e1 \u0159e\u0161en\u00ed nab\u00edz\u00ed. V\u00a0p\u0159\u00edpad\u011b MacQuisitionu je j\u00edm Blacklight a v\u00fdsledky z\u00a0RECON Imageru spolehliv\u011b zpracujeme v\u00a0RECON Labu.\u00a0<\/span><\/p>\n

\u00a0Proto\u017ee za\u0159\u00edzen\u00ed b\u011b\u017e\u00edc\u00ed na macOS funguj\u00ed jinak, ne\u017e ty na Windows, zaji\u0161t\u011bn\u00e1 data se zkoumaj\u00ed jin\u00fdm zp\u016fsobem, i kdy\u017e v\u00fdsledky mohou b\u00fdt obdobn\u00e9. Jednou z\u00a0d\u016fle\u017eit\u00fdch polo\u017eek na seznamu, kter\u00e1 je obdobn\u00e1 souboru Windows.edb jsou tzv. Apple Extended Attributes. D\u00edky t\u011bmto atribut\u016fm je cel\u00fd obsah po\u010d\u00edta\u010de naindexovan\u00fd a lze z nich z\u00edskat zaj\u00edmav\u00e1 data.\u00a0<\/span><\/p>\n

Dal\u0161\u00ed specialitou jsou disky Fusion Drive, kter\u00e9 spojuj\u00ed v\u00edce fyzick\u00fdch disk\u016f a jsou zobrazov\u00e1ny jako jeden. P\u016fvodn\u00ed my\u0161lenka tohoto syst\u00e9mu byla vyu\u017e\u00edt men\u0161\u00ed disk SSD na operace vy\u017eaduj\u00edc\u00ed rychl\u00fd p\u0159\u00edstup a v\u011bt\u0161\u00ed disk HDD na objemn\u00e1 a m\u00e9n\u011b \u010dasto pot\u0159ebn\u00e1 data. Tyto disky byly p\u016fvodn\u011b instalovan\u00e9 z\u00a0v\u00fdroby jako jeden disk, nicm\u00e9n\u011b Fusion Drive m\u016f\u017ee b\u00fdt pou\u017eit\u00fd i na v\u00edce fyzick\u00fdch disc\u00edch najednou. Probl\u00e9m pak nast\u00e1v\u00e1 v\u00a0moment\u011b, kdy zajist\u00edme 2 disky a ka\u017ed\u00fd zvl\u00e1\u0161\u0165 nech\u00e1me zpracovat. Podobn\u011b jako u RAIDu z\u00a0disk\u016f nebudeme schopni zpracovat \u017e\u00e1dn\u00e1 data. Samoz\u0159ejm\u011b je mo\u017en\u00e9 disky pozd\u011bji spojit na za\u0159\u00edzen\u00ed macOS a vytvo\u0159it z\u00a0nich novou image, ale lep\u0161\u00ed mo\u017enost je tomu p\u0159edej\u00edt u\u017eit\u00edm zm\u00edn\u011bn\u00fdch n\u00e1stroj\u016f.<\/span><\/p>\n

Obdobou Volume Shadow Copies ze za\u0159\u00edzen\u00ed Windows jsou Local Time Machine Snapshots. Ty vyu\u017e\u00edv\u00e1 aplikace Time Machine v\u00a0p\u0159\u00edpad\u011b, \u017ee se z\u00e1lohy prov\u00e1d\u00ed p\u0159\u00edmo na za\u0159\u00edzen\u00ed, ne na jin\u00fd c\u00edlov\u00fd disk. Jejich anal\u00fdza m\u016f\u017ee odhalit r\u016fzn\u00e9 star\u0161\u00ed verze soubor\u016f, nebo n\u011bkter\u00e9 ji\u017e smazan\u00e9 soubory.<\/p>\n

Hojn\u011b vyu\u017e\u00edvanou funkc\u00ed na macOS je BootCamp. Ten umo\u017e\u0148uje u\u017eivatel\u016fm rozd\u011blit intern\u00ed disk a nainstalovat opera\u010dn\u00ed syst\u00e9m jin\u00fdch v\u00fdrobc\u016f, zejm\u00e9na Windows. Z\u00a0t\u00e9to \u010d\u00e1sti disku jsou oba n\u00e1stroje schopny vytvo\u0159it image, se kterou lze n\u00e1sledn\u011b pracovat jako s\u00a0jak\u00fdmkoli jin\u00fdm obrazem dan\u00e9ho syst\u00e9mu.\u00a0<\/span><\/p>\n

Pou\u017eit\u00ed zm\u00edn\u011bn\u00fdch n\u00e1stroj\u016f je jednoduch\u00e9 a intuitivn\u00ed. Pomoc\u00ed kl\u00e1ves Alt\/Option a tla\u010d\u00edtka zapnut\u00ed se po\u010d\u00edta\u010d zapne ve Startup Manageru. Tam nalezneme mo\u017enost volby startovac\u00edho disku. Mimo Macintosh HD nalezneme v\u00a0p\u0159\u00edpad\u011b RECON Imageru dal\u0161\u00ed t\u0159i spustiteln\u00e9 ikony, z\u00a0t\u011bch je pak nutn\u00e9 vybrat tu spr\u00e1vnou v\u00a0z\u00e1vislosti na modelu po\u010d\u00edta\u010de. V\u00a0cest\u011b m\u016f\u017ee zabr\u00e1nit ji\u017e zm\u00edn\u011bn\u00fd Secure Boot a nebo Firmware Password, kter\u00fd v\u0161ak Apple Certified Technician m\u016f\u017ee odstranit. Po nabootov\u00e1n\u00ed se zobraz\u00ed okno macOS Utilities, kde je nutn\u00e9 vybrat aplikaci RECON Imager a zvolit Continue.\u00a0<\/span><\/p>\n

N\u00e1sledn\u011b se zobraz\u00ed okno aplikace. V\u00a0horn\u00ed \u010d\u00e1sti je n\u011bkolik ikon, kter\u00e9 otev\u00edraj\u00ed okna dan\u00fdch funkc\u00ed. Seznam v\u0161ech p\u0159ipojen\u00fdch za\u0159\u00edzen\u00ed a intern\u00edch disk\u016f se nal\u00e9z\u00e1 hned pod tou prvn\u00ed, s\u00a0n\u00e1zvem Disk Manager. Mimo b\u011b\u017en\u00e9 informace (model, velikost, typ, souborov\u00fd syst\u00e9m) zobrazuje Disk Manager i informace o spu\u0161t\u011bn\u00e9m \u0161ifrov\u00e1n\u00ed (FileVault), nebo disc\u00edch ve Fusion Drive. P\u0159ed zaji\u0161\u0165ov\u00e1n\u00edm za\u0161ifrovan\u00e9ho disku je mo\u017enost jej hned de\u0161ifrovat pomoc\u00ed hesla nebo recovery kl\u00ed\u010de.\u00a0<\/span><\/p>\n

Disk Imager zajist\u00ed, jak ji\u017e n\u00e1zev napov\u00edd\u00e1, vytvo\u0159en\u00ed image disku. RECON Imager um\u00ed zaji\u0161\u0165ovat v\u00a0b\u011b\u017en\u00fdch form\u00e1tech \u2013 DD, E01, Ex01, nebo DMG. Logicky data zajist\u00ed do slo\u017eky, archivu, nebo zm\u00edn\u011bn\u00e9ho DMG form\u00e1tu, ten je ov\u0161em nad\u00e1le spustiteln\u00fd jen na za\u0159\u00edzen\u00edch Apple. P\u0159ed spu\u0161t\u011bn\u00edm lze samoz\u0159ejm\u011b vybrat c\u00edl, zadat n\u00e1zev, vlastn\u00edka, nebo s\u00e9riov\u00e9 \u010d\u00edslo za\u0159\u00edzen\u00ed. Je mo\u017en\u00e9 tak\u00e9 vybrat datumov\u011b jen n\u011bkter\u00e9 z\u00e1lohy (Time Machine Snapshots).<\/span><\/p>\n

Samoz\u0159ejmost\u00ed je i verifikace image, u fyzick\u00fdch form\u00e1tu lze spo\u010d\u00edtat kontroln\u00ed sumy MD5 a SHA-1. U logick\u00fdch lze ud\u011blat to sam\u00e9, je ale nutn\u00e9 po\u010d\u00edtat s\u00a0prodlou\u017een\u00edm doby zpracov\u00e1n\u00ed, proto\u017ee se kontroln\u00ed sumy budou po\u010d\u00edtat i na vstupn\u00edch souborech. V\u00fdhodou n\u00e1sledn\u00e9ho procesov\u00e1n\u00ed v\u00a0aplikaci RECON Lab je, \u017ee zvl\u00e1d\u00e1 zpracovat i Apple Extended Metadata, kter\u00e1 jsou specialitou souborov\u00e9ho syst\u00e9mu APFS a v\u00a0jist\u00fdch p\u0159\u00edpadech mohou ukl\u00e1dat podstatn\u00e1 data o souborech, ale o tom a\u017e n\u011bkdy p\u0159\u00ed\u0161t\u011b. Pokud se u konkurence do doby vyd\u00e1n\u00ed \u010dl\u00e1nku nic nezm\u011bnilo, bylo SUMURI jedin\u00e9 s\u00a0t\u00edmto \u0159e\u0161en\u00edm na trhu.\u00a0<\/span><\/p>\n

MacQuisition m\u00e1 \u0161ir\u0161\u00ed mo\u017enosti nastavov\u00e1n\u00ed pro zaji\u0161t\u011bn\u00ed. V\u00a0menu m\u00e1 3 d\u016fle\u017eit\u00e9 ikony, prvn\u00ed jsou informace o p\u0159\u00edpadu (Case Details), dal\u0161\u00ed je ikona Data Collection, kter\u00e1 d\u00e1v\u00e1 mo\u017enost nastaven\u00ed typ\u016f dat, kter\u00e1 chceme zajistit. Nastavit lze r\u016fzn\u00e9 u\u017eivatelsk\u00e9 slo\u017eky, typy soubor\u016f, nebo syst\u00e9mov\u00e1 data. V\u00a0n\u011bkter\u00e9m z\u00a0dal\u0161\u00edch \u010dl\u00e1nk\u016f si ur\u010dit\u011b rozebereme, k\u00a0\u010demu r\u016fzn\u00e9 soubory slou\u017e\u00ed a co z\u00a0nich lze z\u00edskat.\u00a0<\/span><\/p>\n

Vytvo\u0159en\u00ed image v\u00a0MacQuisitionu je podobn\u011b jednoduch\u00e9, jako v\u00a0RECON Labu. Sta\u010d\u00ed vybrat disk, form\u00e1t, kontroln\u00ed sumy a c\u00edlovou destinaci, to v\u0161e se skr\u00fdv\u00e1 v\u00a0posledn\u00ed d\u016fle\u017eit\u00e9 ikon\u011b Image Device. Image lze zapsat i na disk ve form\u00e1tu NTFS, co\u017e nen\u00ed standartn\u00ed vlastnost po\u010d\u00edta\u010d\u016f b\u011b\u017e\u00edc\u00edch na macOS. Nespornou v\u00fdhodou MacQuisitonu je mo\u017enost zaji\u0161\u0165ov\u00e1n\u00ed dat na b\u011b\u017e\u00edc\u00edm po\u010d\u00edta\u010di. Na to SUMURI myslelo dal\u0161\u00edm softwarem \u2013 RECON Triage.<\/span><\/p>\n

K\u00a0zaji\u0161\u0165ov\u00e1n\u00ed dat na b\u011b\u017e\u00edc\u00edm po\u010d\u00edta\u010di samoz\u0159ejm\u011b nejsou t\u0159eba v\u00fd\u0161e zmi\u0148ovan\u00e1 \u0159e\u0161en\u00ed. Bez hlub\u0161\u00edch znalost\u00ed syst\u00e9mu a p\u0159\u00edkaz\u016f v\u00a0Termin\u00e1lu n\u00e1m ale zna\u010dn\u011b uleh\u010d\u00ed \u017eivot. M\u016f\u017eeme si ale uk\u00e1zat alespo\u0148 p\u00e1r z\u00e1kladn\u00edch p\u0159\u00edkaz\u016f, kter\u00e9 n\u00e1m pom\u016f\u017eou p\u0159i zaji\u0161\u0165ov\u00e1n\u00ed.\u00a0<\/span><\/p>\n

N\u00e1sleduj\u00edc\u00ed p\u0159\u00edkaz vyp\u00ed\u0161e seznam u\u017eivatel\u016f a ulo\u017e\u00ed jej to souboru form\u00e1tu txt. N\u00e1zev souboru si m\u016f\u017eete samoz\u0159ejm\u011b vybrat, stejn\u011b jako cestu.<\/p>\n

dscl . list \/Users | grep -v\u00a0\u00a0\u2018_\u2018 > users.txt\u00a0<\/strong><\/p>\n

Informace o po\u010d\u00edta\u010di a dal\u0161\u00ed informace jako nainstalovan\u00e9 aplikace vyp\u00ed\u0161ou tyto p\u0159\u00edkazy.\u00a0<\/span><\/p>\n

system_profiler -detailLevel full SPHardwareDataType > hwdatatype.txt<\/strong><\/p>\n

system_profiler -detailLevel full SPApplicationsDataType > apps.txt<\/strong><\/p>\n

system_profiler -detailLevel full SPSerialATADataType > hdd.txt<\/strong><\/p>\n

system_profiler -detailLevel full SPNVMeDataType > hdd2.txt<\/strong><\/p>\n

system_profiler -detailLevel full SPUSBDataType > usb.txt<\/strong><\/p>\n

system_profiler -detailLevel full SPInstallHistoryDataType > apps.txt<\/strong><\/p>\n

Kontroln\u00ed sou\u010det SHA-1 zkop\u00edrovan\u00fdch, nebo jinak pot\u0159ebn\u00fdch soubor\u016f zajist\u00edme n\u00e1sleduj\u00edc\u00edm p\u0159\u00edkazem. Te\u010dka zna\u010d\u00ed aktu\u00e1ln\u00ed m\u00edsto (slo\u017eku), ve kter\u00e9 se nach\u00e1z\u00edme. Lze nahradit jakoukoli cestou.<\/span><\/p>\n

find . -exec shasum {} \\; > sum.txt<\/strong><\/span><\/p>\n

Zaji\u0161\u0165ov\u00e1n\u00ed dat na za\u0159\u00edzen\u00edch Apple nen\u00ed nikterak slo\u017eit\u00e9, sta\u010d\u00ed zn\u00e1t drobn\u00e9 z\u00e1klady a p\u00e1r odli\u0161nost\u00ed, kter\u00e9 se dan\u00e9ho syst\u00e9mu t\u00fdkaj\u00ed. Probl\u00e9m m\u016f\u017ee b\u00fdt s\u00a0\u010dipem T2 nebo \u0161ifrov\u00e1n\u00edm FileVault, na druhou stranu to nen\u00ed nic nov\u00e9ho, s\u00a0\u010d\u00edm bychom se na po\u010d\u00edta\u010d\u00edch s\u00a0Windows je\u0161t\u011b nesetkali. Rozhodn\u011b se vyplat\u00ed k\u00a0zaji\u0161\u0165ov\u00e1n\u00ed vyu\u017e\u00edvat \u0159e\u0161en\u00ed od BlackBagTechu nebo Sumuri, to m\u016f\u017ee zjednodu\u0161it cel\u00fd proces, nav\u00edc v\u00a0kombinaci s\u00a0jejich n\u00e1stroji pro n\u00e1slednou anal\u00fdzu. Jejich n\u00e1stroje dosud na trhu nemaj\u00ed konkurenci.\u00a0<\/span><\/p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]","protected":false},"excerpt":{"rendered":"

St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z\u00a0nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost a ochranu dat sv\u00fdch z\u00e1kazn\u00edk\u016f, a tak se zaji\u0161\u0165ov\u00e1n\u00ed a zkouman\u00ed dat z t\u011bchto za\u0159\u00edzen\u00ed st\u00e1v\u00e1 st\u00e1le slo\u017eit\u011bj\u0161\u00ed. Uk\u00e1zkov\u00fd p\u0159\u00edklad jejich u\u017e star\u0161\u00ed novinky je \u010dip T2, kter\u00fd seskupuje n\u011bkter\u00e9 \u0159adi\u010de, kter\u00e9 se […]<\/p>","protected":false},"author":2,"featured_media":1569,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"\n

St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost a ochranu dat sv\u00fdch z\u00e1kazn\u00edk\u016f, a tak se zaji\u0161\u0165ov\u00e1n\u00ed a zkouman\u00ed dat z t\u011bchto za\u0159\u00edzen\u00ed st\u00e1v\u00e1 st\u00e1le slo\u017eit\u011bj\u0161\u00ed. Uk\u00e1zkov\u00fd p\u0159\u00edklad jejich u\u017e star\u0161\u00ed novinky je \u010dip T2, kter\u00fd seskupuje n\u011bkter\u00e9 \u0159adi\u010de, kter\u00e9 se nach\u00e1zely v po\u010d\u00edta\u010di na r\u016fzn\u00fdch m\u00edstech. Stoj\u00ed tak nad cel\u00fdm syst\u00e9mem a t\u00edm umo\u017e\u0148uje lep\u0161\u00ed zabezpe\u010den\u00ed \u2013 slou\u017e\u00ed jako z\u00e1klad pro \u0161ifrov\u00e1n\u00ed cel\u00e9ho \u00falo\u017ei\u0161t\u011b a zabezpe\u010den\u00e9ho spou\u0161t\u011bn\u00ed. I p\u0159esto u\u017e dnes existuj\u00ed mo\u017enosti, jak tento typ za\u0159\u00edzen\u00ed zajistit. My se v tomto \u010dl\u00e1nku pokus\u00edme pod\u00edvat na \u00fapln\u00e9 z\u00e1klady zaji\u0161\u0165ov\u00e1n\u00ed dat z po\u010d\u00edta\u010d\u016f od firmy Apple. <\/p>\n\n\n\n

Po p\u0159\u00edchodu k vypnut\u00e9mu a zaheslovan\u00e9mu po\u010d\u00edta\u010di, m\u016f\u017eeme postupovat klasick\u00fdm zp\u016fsobem. P\u0159i \u0161t\u011bst\u00ed se dnes je\u0161t\u011b m\u016f\u017eeme dostat ke star\u0161\u00edm MacBook\u016fm, kter\u00e9 jsou vybaveny vym\u011bniteln\u00fdm diskem. Star\u0161\u00ed modely Unibody MacBooku Pro (2008-2012) v\u011bt\u0161inou obsahuj\u00ed klasick\u00fd SATA 2,5\u201c disk, ze kter\u00e9ho je mo\u017en\u00e9 pak ud\u011blat kopii pomoc\u00ed blok\u00e1toru nebo duplik\u00e1toru. Pozd\u011bj\u0161\u00ed MacBooky Pro s retina displejem (2012-2015) maj\u00ed m\u00edsto klasick\u00fdch disk\u016f flash pam\u011b\u0165, kter\u00e1 se jev\u00ed jako SSD s rozhran\u00edm M.2, ale z v\u00fdroby tomu tak nen\u00ed. Je nutn\u00e9 pou\u017e\u00edt redukci pr\u00e1v\u011b na M.2, aby se disk dal bez probl\u00e9mu p\u0159ipojit. <\/p>\n\n\n\n

Posledn\u00ed modely v\u0161ech Macbook\u016f (2015 - dodnes) maj\u00ed pam\u011b\u0165ov\u00fd \u010dip p\u0159ip\u00e1jen\u00fd na desce, proto jej nen\u00ed mo\u017en\u00e9 jednodu\u0161e demontovat a zajistit data b\u011b\u017en\u00fdm zp\u016fsobem. Ostatn\u00ed modely stoln\u00edch po\u010d\u00edta\u010d\u016f Apple z dne\u0161n\u00ed doby (iMac, Mac mini) jsou na tom obdobn\u011b. V\u00fdjimkou je Mac Pro, kde lze fyzicky disky vyjmout. Nejjednodu\u0161\u0161\u00ed zp\u016fsob, jak z vypnut\u00e9ho po\u010d\u00edta\u010de data zajistit je p\u0159es tzv. Target mode, kter\u00fd z po\u010d\u00edta\u010de ud\u011bl\u00e1 extern\u00ed disk a data tak lze st\u00e1hnout. Do Target modu po\u010d\u00edta\u010d dostaneme zap\u00ednac\u00edm tla\u010d\u00edtkem a stisknut\u00edm kl\u00e1vesy T. Probl\u00e9m nast\u00e1v\u00e1, kdy\u017e za\u0159\u00edzen\u00ed v Target modu p\u0159ipoj\u00edte k po\u010d\u00edta\u010di, kter\u00fd neum\u00ed \u010d\u00edst souborov\u00fd syst\u00e9m Applu. Star\u0161\u00ed souborov\u00fd syst\u00e9m HFS+, v macOS naz\u00fdvan\u00fd Mac OS Extended, vyu\u017e\u00edval Apple do konce roku 2017. S t\u00edm v\u011bt\u0161ina SW a HW dnes nem\u00e1 probl\u00e9m, proto m\u016f\u017eeme takov\u00fd disk zajistit i pomoc\u00ed freeware n\u00e1stroje FTK Imager, nebo p\u0159es forenzn\u00ed duplik\u00e1tor. Velkou p\u0159ek\u00e1\u017ekou p\u0159i zaji\u0161\u0165ov\u00e1n\u00ed m\u016f\u017ee b\u00fdt nov\u00fd souborov\u00fd syst\u00e9m Apple File System (APFS), se kter\u00fdm si v\u011bt\u0161ina n\u00e1stroj\u016f dodnes neum\u00ed poradit. Nejjednodu\u0161\u0161\u00edm p\u0159\u00edkladem, jak po\u010d\u00edta\u010d s APFS zajistit v Target modu, je s vyu\u017eit\u00edm po\u010d\u00edta\u010de b\u011b\u017e\u00edc\u00edm na macOS. Ten toti\u017e za\u0159\u00edzen\u00ed bez probl\u00e9mu rozpozn\u00e1, v p\u0159\u00edpad\u011b vyu\u017eit\u00ed \u0161ifrov\u00e1n\u00ed FileVault 2 (p\u0159edchoz\u00ed generace \u0161ifrovala jen domovskou slo\u017eku) je mo\u017en\u00e9 zadat heslo a tak disk okam\u017eit\u011b proch\u00e1zet. Vytvo\u0159en\u00ed image ve form\u00e1tu .dd je mo\u017en\u00e9 p\u0159es jednoduch\u00fd p\u0159\u00edkaz v Termin\u00e1lu. Image lze vytvo\u0159it i bez zad\u00e1n\u00ed hesla. <\/p>\n\n\n\n

Pro vytvo\u0159en\u00ed obrazu disku ve form\u00e1tu .dd je pot\u0159eba nejd\u0159\u00edve ov\u011b\u0159it, kter\u00fd disk hled\u00e1me. K tomu napom\u016f\u017ee p\u0159\u00edkaz:<\/p>\n\n\n\n

$ diskutil list<\/strong><\/p>\n\n\n\n

V p\u0159\u00edpad\u011b, \u017ee jsme disk p\u0159ipojili de\u0161ifrovan\u00fd, nebo jsme zadali heslo, je t\u0159eba disk softwarov\u011b vysunout. V opa\u010dn\u00e9m p\u0159\u00edpad\u011b tento p\u0159\u00edkaz m\u016f\u017eeme ignorovat.<\/p>\n\n\n\n

$ diskutil unmountDisk \/dev\/diskX<\/strong> \/\/X pouze vym\u011bn\u00edme za \u010d\u00edslo vybran\u00e9ho disku<\/p>\n\n\n\n

Te\u010f u\u017e pouze s p\u0159\u00edkazem dd vytvo\u0159\u00edme image po\u017eadovan\u00e9ho disku. V p\u0159\u00edkazu zad\u00e1me za if= zdrojov\u00fd disk a za of= cestu, kam chceme image ulo\u017eit. \u010c\u00edslo ba bs= zna\u010d\u00ed velikost bloku (nen\u00ed nutn\u00e9 m\u00edt v p\u0159\u00edkazu v\u016fbec).<\/p>\n\n\n\n

$ sudo dd if=\/dev\/diskX of=\/Volumes\/image.dd bs=1m<\/strong><\/p>\n\n\n\n

Pokud chceme kontrolovat pr\u016fb\u011bh vytv\u00e1\u0159en\u00ed image, kl\u00e1vesovou zkratkou Ctrl + Shift + T zjist\u00edme aktu\u00e1ln\u00ed stav. <\/p>\n\n\n\n

Jednou z dal\u0161\u00edch mo\u017enost\u00ed, jak vytvo\u0159it image z po\u010d\u00edta\u010d\u016f Apple, je vyu\u017eit\u00ed speci\u00e1ln\u00edch n\u00e1stroj\u016f. Nejb\u011b\u017en\u011bj\u0161\u00edm je \u0159e\u0161en\u00ed MacQuisition od firmy BlackBagTech, dal\u0161\u00ed mo\u017enost\u00ed je RECON Imager od SUMURI. Oba produkty funguj\u00ed obdobn\u00fdm zp\u016fsobem, dok\u00e1\u017e\u00ed pracovat s APFS, FileVault 2, Fusion Drive a zvl\u00e1dnou zajistit data RAM i bez zad\u00e1n\u00ed hesla. Dokonce se po \u010derstv\u00fdch updatech zvl\u00e1dnou vypo\u0159\u00e1dat i s \u010dipem T2. To v praxi znamen\u00e1, \u017ee lze zajistit za\u0159\u00edzen\u00ed bez probl\u00e9m\u016f p\u0159es Target mode z jin\u00e9ho za\u0159\u00edzen\u00ed Apple, v opa\u010dn\u00e9m p\u0159\u00edpad\u011b je nutn\u00e9 zn\u00e1t administr\u00e1torsk\u00e9 \u00fadaje a vypnout Secure Boot. <\/p>\n\n\n\n

U dan\u00fdch \u0159e\u0161en\u00ed je mo\u017en\u00e9 zajistit data tak, aby \u0161la zpracovat v jak\u00e9mkoli forenzn\u00edm n\u00e1stroji \u2013 na logick\u00e9 \u00farovni. Souborov\u00fd syst\u00e9m APFS u\u017e \u010d\u00e1ste\u010dn\u011b zvl\u00e1d\u00e1 i EnCase nebo Magnet AXIOM. Nejlep\u0161\u00ed je samoz\u0159ejm\u011b pracovat se softwarem od firmy, kter\u00e1 \u0159e\u0161en\u00ed nab\u00edz\u00ed. V p\u0159\u00edpad\u011b MacQuisitionu je j\u00edm Blacklight a v\u00fdsledky z RECON Imageru spolehliv\u011b zpracujeme v RECON Labu. <\/p>\n\n\n\n

Proto\u017ee za\u0159\u00edzen\u00ed b\u011b\u017e\u00edc\u00ed na macOS funguj\u00ed jinak, ne\u017e ty na Windows, zaji\u0161t\u011bn\u00e1 data se zkoumaj\u00ed jin\u00fdm zp\u016fsobem, i kdy\u017e v\u00fdsledky mohou b\u00fdt obdobn\u00e9. Jednou z d\u016fle\u017eit\u00fdch polo\u017eek na seznamu, kter\u00e1 je obdobn\u00e1 souboru Windows.edb jsou tzv. Apple Extended Attributes. D\u00edky t\u011bmto atribut\u016fm je cel\u00fd obsah po\u010d\u00edta\u010de naindexovan\u00fd a lze z nich z\u00edskat zaj\u00edmav\u00e1 data. <\/p>\n\n\n\n

Dal\u0161\u00ed specialitou jsou disky Fusion Drive, kter\u00e9 spojuj\u00ed v\u00edce fyzick\u00fdch disk\u016f a jsou zobrazov\u00e1ny jako jeden. P\u016fvodn\u00ed my\u0161lenka tohoto syst\u00e9mu byla vyu\u017e\u00edt men\u0161\u00ed disk SSD na operace vy\u017eaduj\u00edc\u00ed rychl\u00fd p\u0159\u00edstup a v\u011bt\u0161\u00ed disk HDD na objemn\u00e1 a m\u00e9n\u011b \u010dasto pot\u0159ebn\u00e1 data. Tyto disky byly p\u016fvodn\u011b instalovan\u00e9 z v\u00fdroby jako jeden disk, nicm\u00e9n\u011b Fusion Drive m\u016f\u017ee b\u00fdt pou\u017eit\u00fd i na v\u00edce fyzick\u00fdch disc\u00edch najednou. Probl\u00e9m pak nast\u00e1v\u00e1 v moment\u011b, kdy zajist\u00edme 2 disky a ka\u017ed\u00fd zvl\u00e1\u0161\u0165 nech\u00e1me zpracovat. Podobn\u011b jako u RAIDu z disk\u016f nebudeme schopni zpracovat \u017e\u00e1dn\u00e1 data. Samoz\u0159ejm\u011b je mo\u017en\u00e9 disky pozd\u011bji spojit na za\u0159\u00edzen\u00ed macOS a vytvo\u0159it z nich novou image, ale lep\u0161\u00ed mo\u017enost je tomu p\u0159edej\u00edt u\u017eit\u00edm zm\u00edn\u011bn\u00fdch n\u00e1stroj\u016f.<\/p>\n\n\n\n

Obdobou Volume Shadow Copies ze za\u0159\u00edzen\u00ed Windows jsou Local Time Machine Snapshots. Ty vyu\u017e\u00edv\u00e1 aplikace Time Machine v p\u0159\u00edpad\u011b, \u017ee se z\u00e1lohy prov\u00e1d\u00ed p\u0159\u00edmo na za\u0159\u00edzen\u00ed, ne na jin\u00fd c\u00edlov\u00fd disk. Jejich anal\u00fdza m\u016f\u017ee odhalit r\u016fzn\u00e9 star\u0161\u00ed verze soubor\u016f, nebo n\u011bkter\u00e9 ji\u017e smazan\u00e9 soubory. <\/p>\n\n\n\n

Hojn\u011b vyu\u017e\u00edvanou funkc\u00ed na macOS je BootCamp. Ten umo\u017e\u0148uje u\u017eivatel\u016fm rozd\u011blit intern\u00ed disk a nainstalovat opera\u010dn\u00ed syst\u00e9m jin\u00fdch v\u00fdrobc\u016f, zejm\u00e9na Windows. Z t\u00e9to \u010d\u00e1sti disku jsou oba n\u00e1stroje schopny vytvo\u0159it image, se kterou lze n\u00e1sledn\u011b pracovat jako s jak\u00fdmkoli jin\u00fdm obrazem dan\u00e9ho syst\u00e9mu. <\/p>\n\n\n\n

Pou\u017eit\u00ed zm\u00edn\u011bn\u00fdch n\u00e1stroj\u016f je jednoduch\u00e9 a intuitivn\u00ed. Pomoc\u00ed kl\u00e1ves Alt\/Option a tla\u010d\u00edtka zapnut\u00ed se po\u010d\u00edta\u010d zapne ve Startup Manageru. Tam nalezneme mo\u017enost volby startovac\u00edho disku. Mimo Macintosh HD nalezneme v p\u0159\u00edpad\u011b RECON Imageru dal\u0161\u00ed t\u0159i spustiteln\u00e9 ikony, z t\u011bch je pak nutn\u00e9 vybrat tu spr\u00e1vnou v z\u00e1vislosti na modelu po\u010d\u00edta\u010de. V cest\u011b m\u016f\u017ee zabr\u00e1nit ji\u017e zm\u00edn\u011bn\u00fd Secure Boot a nebo Firmware Password, kter\u00fd v\u0161ak Apple Certified Technician m\u016f\u017ee odstranit. Po nabootov\u00e1n\u00ed se zobraz\u00ed okno macOS Utilities, kde je nutn\u00e9 vybrat aplikaci RECON Imager a zvolit Continue. <\/p>\n\n\n\n

N\u00e1sledn\u011b se zobraz\u00ed okno aplikace. V horn\u00ed \u010d\u00e1sti je n\u011bkolik ikon, kter\u00e9 otev\u00edraj\u00ed okna dan\u00fdch funkc\u00ed. Seznam v\u0161ech p\u0159ipojen\u00fdch za\u0159\u00edzen\u00ed a intern\u00edch disk\u016f se nal\u00e9z\u00e1 hned pod tou prvn\u00ed, s n\u00e1zvem Disk Manager. Mimo b\u011b\u017en\u00e9 informace (model, velikost, typ, souborov\u00fd syst\u00e9m) zobrazuje Disk Manager i informace o spu\u0161t\u011bn\u00e9m \u0161ifrov\u00e1n\u00ed (FileVault), nebo disc\u00edch ve Fusion Drive. P\u0159ed zaji\u0161\u0165ov\u00e1n\u00edm za\u0161ifrovan\u00e9ho disku je mo\u017enost jej hned de\u0161ifrovat pomoc\u00ed hesla nebo recovery kl\u00ed\u010de. <\/p>\n\n\n\n

Disk Imager zajist\u00ed, jak ji\u017e n\u00e1zev napov\u00edd\u00e1, vytvo\u0159en\u00ed image disku. RECON Imager um\u00ed zaji\u0161\u0165ovat v b\u011b\u017en\u00fdch form\u00e1tech \u2013 DD, E01, Ex01, nebo DMG. Logicky data zajist\u00ed do slo\u017eky, archivu, nebo zm\u00edn\u011bn\u00e9ho DMG form\u00e1tu, ten je ov\u0161em nad\u00e1le spustiteln\u00fd jen na za\u0159\u00edzen\u00edch Apple. P\u0159ed spu\u0161t\u011bn\u00edm lze samoz\u0159ejm\u011b vybrat c\u00edl, zadat n\u00e1zev, vlastn\u00edka, nebo s\u00e9riov\u00e9 \u010d\u00edslo za\u0159\u00edzen\u00ed. Je mo\u017en\u00e9 tak\u00e9 vybrat datumov\u011b jen n\u011bkter\u00e9 z\u00e1lohy (Time Machine Snapshots).<\/p>\n\n\n\n

Samoz\u0159ejmost\u00ed je i verifikace image, u fyzick\u00fdch form\u00e1tu lze spo\u010d\u00edtat kontroln\u00ed sumy MD5 a SHA-1. U logick\u00fdch lze ud\u011blat to sam\u00e9, je ale nutn\u00e9 po\u010d\u00edtat s prodlou\u017een\u00edm doby zpracov\u00e1n\u00ed, proto\u017ee se kontroln\u00ed sumy budou po\u010d\u00edtat i na vstupn\u00edch souborech. V\u00fdhodou n\u00e1sledn\u00e9ho procesov\u00e1n\u00ed v aplikaci RECON Lab je, \u017ee zvl\u00e1d\u00e1 zpracovat i Apple Extended Metadata, kter\u00e1 jsou specialitou souborov\u00e9ho syst\u00e9mu APFS a v jist\u00fdch p\u0159\u00edpadech mohou ukl\u00e1dat podstatn\u00e1 data o souborech, ale o tom a\u017e n\u011bkdy p\u0159\u00ed\u0161t\u011b. Pokud se u konkurence do doby vyd\u00e1n\u00ed \u010dl\u00e1nku nic nezm\u011bnilo, bylo SUMURI jedin\u00e9 s t\u00edmto \u0159e\u0161en\u00edm na trhu. <\/p>\n\n\n\n

MacQuisition m\u00e1 \u0161ir\u0161\u00ed mo\u017enosti nastavov\u00e1n\u00ed pro zaji\u0161t\u011bn\u00ed. V menu m\u00e1 3 d\u016fle\u017eit\u00e9 ikony, prvn\u00ed jsou informace o p\u0159\u00edpadu (Case Details), dal\u0161\u00ed je ikona Data Collection, kter\u00e1 d\u00e1v\u00e1 mo\u017enost nastaven\u00ed typ\u016f dat, kter\u00e1 chceme zajistit. Nastavit lze r\u016fzn\u00e9 u\u017eivatelsk\u00e9 slo\u017eky, typy soubor\u016f, nebo syst\u00e9mov\u00e1 data. V n\u011bkter\u00e9m z dal\u0161\u00edch \u010dl\u00e1nk\u016f si ur\u010dit\u011b rozebereme, k \u010demu r\u016fzn\u00e9 soubory slou\u017e\u00ed a co z nich lze z\u00edskat. <\/p>\n\n\n\n

Vytvo\u0159en\u00ed image v MacQuisitionu je podobn\u011b jednoduch\u00e9, jako v RECON Labu. Sta\u010d\u00ed vybrat disk, form\u00e1t, kontroln\u00ed sumy a c\u00edlovou destinaci, to v\u0161e se skr\u00fdv\u00e1 v posledn\u00ed d\u016fle\u017eit\u00e9 ikon\u011b Image Device. Image lze zapsat i na disk ve form\u00e1tu NTFS, co\u017e nen\u00ed standartn\u00ed vlastnost po\u010d\u00edta\u010d\u016f b\u011b\u017e\u00edc\u00edch na macOS. Nespornou v\u00fdhodou MacQuisitonu je mo\u017enost zaji\u0161\u0165ov\u00e1n\u00ed dat na b\u011b\u017e\u00edc\u00edm po\u010d\u00edta\u010di. Na to SUMURI myslelo dal\u0161\u00edm softwarem \u2013 RECON Triage. <\/p>\n\n\n\n

K zaji\u0161\u0165ov\u00e1n\u00ed dat na b\u011b\u017e\u00edc\u00edm po\u010d\u00edta\u010di samoz\u0159ejm\u011b nejsou t\u0159eba v\u00fd\u0161e zmi\u0148ovan\u00e1 \u0159e\u0161en\u00ed. Bez hlub\u0161\u00edch znalost\u00ed syst\u00e9mu a p\u0159\u00edkaz\u016f v Termin\u00e1lu n\u00e1m ale zna\u010dn\u011b uleh\u010d\u00ed \u017eivot. M\u016f\u017eeme si ale uk\u00e1zat alespo\u0148 p\u00e1r z\u00e1kladn\u00edch p\u0159\u00edkaz\u016f, kter\u00e9 n\u00e1m pom\u016f\u017eou p\u0159i zaji\u0161\u0165ov\u00e1n\u00ed. <\/p>\n\n\n\n

N\u00e1sleduj\u00edc\u00ed p\u0159\u00edkaz vyp\u00ed\u0161e seznam u\u017eivatel\u016f a ulo\u017e\u00ed jej to souboru form\u00e1tu txt. N\u00e1zev souboru si m\u016f\u017eete samoz\u0159ejm\u011b vybrat, stejn\u011b jako cestu. <\/p>\n\n\n\n

dscl . list \/Users | grep -v  \u2018_\u2018 > users.txt <\/strong><\/p>\n\n\n\n

Informace o po\u010d\u00edta\u010di a dal\u0161\u00ed informace jako nainstalovan\u00e9 aplikace vyp\u00ed\u0161ou tyto p\u0159\u00edkazy. <\/p>\n\n\n\n

system_profiler -detailLevel full SPHardwareDataType > hwdatatype.txt<\/strong><\/p>\n\n\n\n


system_profiler -detailLevel full SPApplicationsDataType > apps.txt<\/strong><\/p>\n\n\n\n


system_profiler -detailLevel full SPSerialATADataType > hdd.txt<\/strong><\/p>\n\n\n\n


system_profiler -detailLevel full SPNVMeDataType > hdd2.txt<\/strong><\/p>\n\n\n\n


system_profiler -detailLevel full SPUSBDataType > usb.txt<\/strong><\/p>\n\n\n\n


system_profiler -detailLevel full SPInstallHistoryDataType > apps.txt<\/strong><\/p>\n\n\n\n

Kontroln\u00ed sou\u010det SHA-1 zkop\u00edrovan\u00fdch, nebo jinak pot\u0159ebn\u00fdch soubor\u016f zajist\u00edme n\u00e1sleduj\u00edc\u00edm p\u0159\u00edkazem. Te\u010dka zna\u010d\u00ed aktu\u00e1ln\u00ed m\u00edsto (slo\u017eku), ve kter\u00e9 se nach\u00e1z\u00edme. Lze nahradit jakoukoli cestou.<\/p>\n\n\n\n

find . -exec shasum {} \\; > sum.txt<\/p>\n\n\n\n

Zaji\u0161\u0165ov\u00e1n\u00ed dat na za\u0159\u00edzen\u00edch Apple nen\u00ed nikterak slo\u017eit\u00e9, sta\u010d\u00ed zn\u00e1t drobn\u00e9 z\u00e1klady a p\u00e1r odli\u0161nost\u00ed, kter\u00e9 se dan\u00e9ho syst\u00e9mu t\u00fdkaj\u00ed. Probl\u00e9m m\u016f\u017ee b\u00fdt s \u010dipem T2 nebo \u0161ifrov\u00e1n\u00edm FileVault, na druhou stranu to nen\u00ed nic nov\u00e9ho, s \u010d\u00edm bychom se na po\u010d\u00edta\u010d\u00edch s Windows je\u0161t\u011b nesetkali. Rozhodn\u011b se vyplat\u00ed k zaji\u0161\u0165ov\u00e1n\u00ed vyu\u017e\u00edvat \u0159e\u0161en\u00ed od BlackBagTechu nebo Sumuri, to m\u016f\u017ee zjednodu\u0161it cel\u00fd proces, nav\u00edc v kombinaci s jejich n\u00e1stroji pro n\u00e1slednou anal\u00fdzu. Jejich n\u00e1stroje dosud na trhu nemaj\u00ed konkurenci. <\/p>\n","_et_gb_content_width":"","footnotes":""},"categories":[6,4],"tags":[],"class_list":["post-807","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forenzni-analyza","category-forenzni-nastroje"],"yoast_head":"\nZ\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee<\/title>\n<meta name=\"description\" content=\"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.forensee.cz\/en\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Z\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee\" \/>\n<meta property=\"og:description\" content=\"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.forensee.cz\/en\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\" \/>\n<meta property=\"og:site_name\" content=\"forensee\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/forensee\" \/>\n<meta property=\"article:published_time\" content=\"2019-05-27T10:18:43+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-03-16T16:06:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2019\/05\/dreamstime_xxl_139990440-2-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Dominik Nov\u00e1k\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@forensee\" \/>\n<meta name=\"twitter:site\" content=\"@forensee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dominik Nov\u00e1k\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\"},\"author\":{\"name\":\"Dominik Nov\u00e1k\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/264d6b001b6836c949332e02a8934190\"},\"headline\":\"Z\u00e1klady forenzn\u00ed anal\u00fdzy na macOS\",\"datePublished\":\"2019-05-27T10:18:43+00:00\",\"dateModified\":\"2021-03-16T16:06:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\"},\"wordCount\":2270,\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"articleSection\":[\"Forenzn\u00ed anal\u00fdza\",\"Forenzn\u00ed n\u00e1stroje\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\",\"url\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\",\"name\":\"Z\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/#website\"},\"datePublished\":\"2019-05-27T10:18:43+00:00\",\"dateModified\":\"2021-03-16T16:06:16+00:00\",\"description\":\"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...\",\"breadcrumb\":{\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Dom\u016f\",\"item\":\"https:\/\/www.forensee.cz\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Z\u00e1klady forenzn\u00ed anal\u00fdzy na macOS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.forensee.cz\/#website\",\"url\":\"https:\/\/www.forensee.cz\/\",\"name\":\"forensee\",\"description\":\"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed\",\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.forensee.cz\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.forensee.cz\/#organization\",\"name\":\"forensee\",\"url\":\"https:\/\/www.forensee.cz\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"contentUrl\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"width\":300,\"height\":75,\"caption\":\"forensee\"},\"image\":{\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/forensee\",\"https:\/\/twitter.com\/forensee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/264d6b001b6836c949332e02a8934190\",\"name\":\"Dominik Nov\u00e1k\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ad6e6a5ce09191abf0a35e4212d66afeee16bfd94c7f5e938e0efc4fafbbe15b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ad6e6a5ce09191abf0a35e4212d66afeee16bfd94c7f5e938e0efc4fafbbe15b?s=96&d=mm&r=g\",\"caption\":\"Dominik Nov\u00e1k\"},\"url\":\"https:\/\/www.forensee.cz\/en\/author\/novak\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee","description":"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.forensee.cz\/en\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/","og_locale":"en_US","og_type":"article","og_title":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee","og_description":"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...","og_url":"https:\/\/www.forensee.cz\/en\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/","og_site_name":"forensee","article_publisher":"https:\/\/www.facebook.com\/forensee","article_published_time":"2019-05-27T10:18:43+00:00","article_modified_time":"2021-03-16T16:06:16+00:00","og_image":[{"width":2560,"height":1280,"url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2019\/05\/dreamstime_xxl_139990440-2-scaled.jpg","type":"image\/jpeg"}],"author":"Dominik Nov\u00e1k","twitter_card":"summary_large_image","twitter_creator":"@forensee","twitter_site":"@forensee","twitter_misc":{"Written by":"Dominik Nov\u00e1k","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#article","isPartOf":{"@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/"},"author":{"name":"Dominik Nov\u00e1k","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/264d6b001b6836c949332e02a8934190"},"headline":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na macOS","datePublished":"2019-05-27T10:18:43+00:00","dateModified":"2021-03-16T16:06:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/"},"wordCount":2270,"publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"articleSection":["Forenzn\u00ed anal\u00fdza","Forenzn\u00ed n\u00e1stroje"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/","url":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/","name":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na za\u0159\u00edzen\u00edch s macOS - forensee","isPartOf":{"@id":"https:\/\/www.forensee.cz\/#website"},"datePublished":"2019-05-27T10:18:43+00:00","dateModified":"2021-03-16T16:06:16+00:00","description":"St\u00e1le zvy\u0161uj\u00edc\u00ed se po\u010det za\u0159\u00edzen\u00ed Apple navy\u0161uje i po\u010det p\u0159\u00edpad\u016f, kdy je pot\u0159eba data z nich zkoumat. Firma Apple velmi db\u00e1 na bezpe\u010dnost...","breadcrumb":{"@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.forensee.cz\/2019\/05\/27\/zaklady-forenzni-analyzy-na-macos\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Dom\u016f","item":"https:\/\/www.forensee.cz\/"},{"@type":"ListItem","position":2,"name":"Z\u00e1klady forenzn\u00ed anal\u00fdzy na macOS"}]},{"@type":"WebSite","@id":"https:\/\/www.forensee.cz\/#website","url":"https:\/\/www.forensee.cz\/","name":"forensee","description":"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed","publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.forensee.cz\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.forensee.cz\/#organization","name":"forensee","url":"https:\/\/www.forensee.cz\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/","url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","contentUrl":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","width":300,"height":75,"caption":"forensee"},"image":{"@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/forensee","https:\/\/twitter.com\/forensee"]},{"@type":"Person","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/264d6b001b6836c949332e02a8934190","name":"Dominik Nov\u00e1k","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ad6e6a5ce09191abf0a35e4212d66afeee16bfd94c7f5e938e0efc4fafbbe15b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ad6e6a5ce09191abf0a35e4212d66afeee16bfd94c7f5e938e0efc4fafbbe15b?s=96&d=mm&r=g","caption":"Dominik Nov\u00e1k"},"url":"https:\/\/www.forensee.cz\/en\/author\/novak\/"}]}},"_links":{"self":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/comments?post=807"}],"version-history":[{"count":6,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/807\/revisions"}],"predecessor-version":[{"id":1634,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/807\/revisions\/1634"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media\/1569"}],"wp:attachment":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media?parent=807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/categories?post=807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/tags?post=807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}