Sign In
Help


Episode 3 Show Notes

Sorry it took so long but the show notes for Episode 3 are ready. You can either read a shortened version below or download the PDF. The PDF has images that help explain some of the locations and other aspects of what was discussed.

Download Show Notes

Safari Internet Cache:

Original location for Safari 2 and early 3:
     - Users/USERNAME/Library/Caches/Safari/
     - Files were given Unique ID and extension of .cache 

Version 3: switched to a sqlite database file and moved the cache to /var/folders

-Location: /var/folders/(UniqueID)/(UniqueID)/caches/com.apple.Safari
-Cache.db file

-If in Windows environment, ie. Encase, you will not see “/var/folders”, instead it will be:
      -/private/var/folders/(UniqueID)/(UniqueID)/caches/com.apple.Safari

-var/folders view on Mac is called “soft link” as Private is implied

Latest Safari Ver 3 & Version 4 moves the cache back to:

Users/USERNAME/Library/Caches\com.apple.safari

- The Cache.db file resides here. Probable change was security based as it placed te file back in the users folder.

Viewing Safari Cache:

SQLite DB Browser 1.3:

Database: can use SQLite DB browser 1.3 from Sourceforge
-Displays the .db tables
-Example: “Response Table”: has website URL and Date/Time Stamp in GMT

Filejuicer:
-Drop the Cache.db on Filejuicer and it will parse the data out
-Images, HTML, TXT, etc.

Incident Response/Trusted Utilities:
-Often times, whenever out on scene, it is an unknown environment
-Must consider all machines to be unknown and applications possibly  
  altered
-Best way to prepare is to have our own trusted utilities disk
-Recommend a flash drive, minimum 4 GB to use
-If PowerPC: recommend Firewire, if Intel: recommend USB

Trusted Utilities Drive:

1. Disk Initialization (formatting for you Microsofties): Use Disk Utility
    to initialize the drive and wipe it prior to placing tools on it.
2. Put on utilities: i.e. Terminal, System Profiler, etc.
3. Rule of thumb: Command Line Tools/GUI Tools/Evidence Collection.
4. Name the Volume/Disk something you will recognize i.e.
    “RyansTrusted Utilities" This eliminates confusion on Suspectʼs
    desktop
5. Run Trusted Utilities: Date, System Profiler and export information to
   Evidence Collection.
6. Keep record of the commands run for later review and reporting, i.e.
    use PDF printout from Mac builtin utilities.
7. Remember to direct your path to the Trusted Utilities Disk as you are
    never sure what the suspect has done to their machine. Control your 
    environment.


PList(s) of the Week(PLOW):

Address Book:

/Users/USERNAME/Library/Preferences/addressbookme.plist:
-This PList originates information entered at Registration
-Can contain: First Name, Last Name, Local Phone #, Street Address 1     
  and 2, City, State, Zip, Area Code, Local Phone#, Company, Existing  
  email address

/Users/USERNAME/Library/Preferences
List View
Most Popular
Inside the Core

Inside the Core