CONFIDENTIAL FORENSICS Кой · Какво · Кога · Как

# Всички log events от последния час
$ log show --last 1h --info | head -100

# Кога е стартирала/спряла система (boot/shutdown история)
$ log show --predicate 'eventMessage contains "Wake reason"' --last 7d
$ log show --predicate 'eventMessage contains "shutdown cause"' --last 30d

# Кога е отключван екранът (логин история)
$ log show --predicate 'subsystem == "com.apple.loginwindow"' \
    --last 7d --info | grep "Authentication\|Login\|Logout"

# Намери конкретна app по subsystem
$ log show --predicate 'process == "Safari"' --last 24h --info

# Sudo използване — кой е ескалирал привилегии
$ log show --predicate 'process == "sudo"' --last 30d --info
2024-03-15 02:47:33 sudo: alex : TTY=ttys001 ; PWD=/root ; USER=root ; COMMAND=/bin/bash

# App инсталации и uninstall-и
$ log show --predicate 'subsystem == "com.apple.commerce"' --last 30d

# SSH login опити (успешни и неуспешни)
$ log show --predicate 'process == "sshd"' --last 7d --info \
    | grep "Accepted\|Failed\|Invalid"
Accepted publickey for alex from 192.168.1.10
Failed password for root from 185.234.x.x (brute force?)

# VPN конекции
$ log show --predicate 'subsystem == "com.apple.networkextension"' \
    --last 7d | grep "connected\|disconnected"

# Time Machine backup история
$ log show --predicate 'subsystem == "com.apple.TimeMachine"' \
    --last 30d | grep "Starting\|Completed\|Failed"

# Spotlight индексиране — кои файлове са добавени
$ log show --predicate 'process == "mdworker_shared"' \
    --last 1h --debug | grep "Indexing"

# Събери всички logs в архив (за offline анализ)
$ sudo log collect --last 7d --output ~/Desktop/system_logs.logarchive

# Отвори архива с Console.app за GUI анализ
$ open ~/Desktop/system_logs.logarchive

# Или анализирай от CLI
$ log show --archive ~/Desktop/system_logs.logarchive \
    --predicate 'process == "sudo"' --info

# Всички 4 timestamp-а на файл
$ stat ~/Desktop/suspicious_file.zip
16777234 12345678 -rw-r--r-- 1 alex staff 0 2048000 "Mar 15 03:22:14 2024" "Mar 15 03:18:41 2024" "Mar 15 03:18:41 2024" "Mar 14 23:44:02 2024" 4096 4000 0 suspicious_file.zip
#  atime (accessed)^      mtime (modified)^  ctime (changed)^    btime (born)^

# Само дата на създаване (birth time)
$ GetFileInfo -d ~/Desktop/suspicious_file.zip
# или:
$ mdls -name kMDItemFSCreationDate ~/Desktop/suspicious_file.zip
kMDItemFSCreationDate = 2024-03-14 23:44:02 +0000

# Намери всички файлове създадени ДНЕС
$ find ~ -newer "$(date -v0H -v0M -v0S +%Y-%m-%d)" -type f 2>/dev/null

# Файлове модифицирани в последните 24 часа (suspicious)
$ find /usr/local/bin /usr/bin /bin -mtime -1 -type f 2>/dev/null
# Ако system binaries са модифицирани → RED FLAG

# Намери ОГРОМНИ файлове създадени наскоро
$ find ~ -mtime -7 -size +100M -type f 2>/dev/null | sort -k5 -rn

# Recent documents (от NSRecentDocumentsDirectory)
$ ls -lt ~/Library/Application\ Support/com.apple.sharedfilelist/ | head -10

# Recent files за конкретна app
$ defaults read com.apple.finder FXRecentFolders 2>/dev/null
$ defaults read com.apple.recentitems | grep "Name\|Alias"

# Quick Look cache — файлове, разгледани с Space в Finder
$ ls -lt ~/Library/Caches/com.apple.QuickLook.thumbnailcache/

# Spotlight metadata — пълна история на достъпвани файлове
$ mdls -name kMDItemLastUsedDate -name kMDItemDisplayName \
    ~/Documents/*.pdf 2>/dev/null
kMDItemLastUsedDate = 2024-03-15 14:22:08 +0000
kMDItemDisplayName = "Q4_Financial_Report.pdf"

# Всички USB устройства свързвани исторически
$ log show --predicate 'subsystem == "com.apple.iokit.IOUSBFamily"' \
    --last 30d | grep "New device\|USB Device"

# Текущо свързани USB устройства
$ system_profiler SPUSBDataType

# Компактна версия — само имена и IDs
$ system_profiler SPUSBDataType | grep -E "Product ID|Vendor ID|Serial Number|Manufacturer:|^    [A-Z]"

# Thunderbolt / USB-C история
$ system_profiler SPThunderboltDataType | grep "Device Name\|UID"

# Намери кога е монтиран external диск
$ log show --predicate 'eventMessage contains "disk" AND eventMessage contains "mounted"' \
    --last 30d
2024-03-15 02:31:14 kernel: disk3s1: mounted
2024-03-15 02:31:14 kernel: Filesystem "SanDisk 64GB" mounted at /Volumes/SANDISK
2024-03-15 02:47:22 kernel: disk3s1: unmounted
# 16 минути след монтиране → unmount. Какво е копирано?

# Paired Bluetooth устройства (с history)
$ defaults read /Library/Preferences/com.apple.Bluetooth \
    | grep -A 5 "DeviceName\|LastNameUsed"

# Bluetooth свързвания от logs
$ log show --predicate 'subsystem == "com.apple.bluetooth"' \
    --last 7d | grep "Connected\|Disconnected" | head -30

# AirDrop история (приети/изпратени файлове)
$ log show --predicate 'subsystem == "com.apple.sharing"' \
    --last 30d | grep "AirDrop\|received\|sent"

# Всички Wi-Fi мрежи, към които е свързван Mac-ът
$ defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences \
    | grep "SSIDString\|LastConnected\|SecurityType"

# По-четим формат
$ /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I

# Wi-Fi connection история от logs
$ log show --predicate 'subsystem == "com.apple.wifi" AND eventMessage contains "Joined"' \
    --last 30d
2024-03-15 02:29:44 WiFi: Joined SSID: "CoffeeShop_Free" BSSID: aa:bb:cc:dd:ee:ff
2024-03-15 03:01:22 WiFi: Joined SSID: "HomeNetwork_5G"  BSSID: 11:22:33:44:55:66

# Кога и кое мрежово устройство е ползвано
$ log show --predicate 'process == "configd" AND eventMessage contains "Interface"' \
    --last 7d | grep "active\|inactive"

# Network connection история (не е пълна, но полезна)
$ log show --predicate 'process == "mDNSResponder"' \
    --last 24h --debug | grep "Question" | head -50

# Провери /etc/hosts за манипулация
$ cat /etc/hosts
$ stat /etc/hosts   # кога е модифициран?

# Little Snitch / Lulu logs (ако е инсталиран)
$ ls ~/Library/Logs/ | grep -i "snitch\|lulu\|firewall"

# Firewall logs
$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps
$ cat /var/log/appfirewall.log | tail -50

# Намери DNS prefetch history (Safari)
$ log show --predicate 'process == "Safari" AND eventMessage contains "DNS"' \
    --last 24h --debug

# Safari history е SQLite database
$ sqlite3 ~/Library/Safari/History.db \
    "SELECT datetime(visit_time + 978307200, 'unixepoch', 'localtime') as time,
     url, title
     FROM history_visits
     JOIN history_items ON history_visits.history_item = history_items.id
     ORDER BY visit_time DESC LIMIT 50;"
2024-03-15 03:12:44 | https://pastebin.com/xK2mN8qP | Untitled
2024-03-15 03:08:11 | https://wetransfer.com/downloads/... | Download
2024-03-15 02:55:30 | https://news.ycombinator.com | Hacker News

# Safari downloads
$ sqlite3 ~/Library/Safari/Downloads.db \
    "SELECT datetime(start_date + 978307200, 'unixepoch', 'localtime'),
     url, path, total_data_received
     FROM Downloads ORDER BY start_date DESC LIMIT 20;"

# Safari Top Sites (бързо overview)
$ defaults read ~/Library/Safari/TopSites.plist 2>/dev/null \
    | grep "TopSiteURLString"

# Chrome history (SQLite)
$ cp ~/Library/Application\ Support/Google/Chrome/Default/History /tmp/chrome_history.db
$ sqlite3 /tmp/chrome_history.db \
    "SELECT datetime(last_visit_time/1000000-11644473600, 'unixepoch', 'localtime'),
     url, title, visit_count
     FROM urls ORDER BY last_visit_time DESC LIMIT 30;"

# Chrome downloads
$ sqlite3 /tmp/chrome_history.db \
    "SELECT datetime(start_time/1000000-11644473600, 'unixepoch', 'localtime'),
     target_path, tab_url, received_bytes
     FROM downloads ORDER BY start_time DESC LIMIT 20;"

# Firefox история
$ find ~/Library/Application\ Support/Firefox/Profiles -name "places.sqlite"
$ sqlite3 "~/Library/Application Support/Firefox/Profiles/XXXXX.default/places.sqlite" \
    "SELECT datetime(last_visit_date/1000000, 'unixepoch', 'localtime'),
     url, title FROM moz_places
     ORDER BY last_visit_date DESC LIMIT 30;"

# .Trash — изтритото минало през Trash (с timestamp)
$ ls -laht ~/.Trash/
$ ls -laht /.Trashes/   # external drives

# Spotlight знае за изтрити файлове (metadata остава)
$ mdfind "kMDItemDateDeleted == '*'" 2>/dev/null

# Time Machine — намери изтрити файлове в backups
$ tmutil listbackups
$ ls /Volumes/Time\ Machine\ Backups/Backups.backupdb/MacName/YYYY-MM-DD/

# APFS snapshots — локални snapshots (Time Machine)
$ tmutil listlocalsnapshots /
com.apple.TimeMachine.2024-03-14-230012
com.apple.TimeMachine.2024-03-15-010023

# Монтирай snapshot и разгледай
$ sudo tmutil mount com.apple.TimeMachine.2024-03-14-230012

# Файлове отворени от deleted процеси (lsof trick)
$ sudo lsof | grep "(deleted)"
python3  1234  alex  3r  REG  disk1  2048000  /tmp/secret_data.csv (deleted)

# Quick Look thumbnails на изтрити файлове
$ ls -lah ~/Library/Caches/com.apple.QuickLook.thumbnailcache/

# Icon cache — съдържа thumbnails на изтрити файлове
$ sqlite3 ~/Library/Caches/com.apple.iconservices.store \
    ".tables"

# iCloud "Recently Deleted" (30 дни)
$ ls ~/Library/Mobile\ Documents/com~apple~CloudDocs/.Trash/ 2>/dev/null

# Photos library — изтрити снимки (30 дни)
$ sqlite3 ~/Pictures/Photos\ Library.photoslibrary/database/Photos.sqlite \
    "SELECT datetime(ZDATEDELETED + 978307200, 'unixepoch', 'localtime'),
     ZORIGINALFILENAME FROM ZASSET
     WHERE ZTRASHEDSTATE = 1 ORDER BY ZDATEDELETED DESC LIMIT 20;"

# Zsh история с timestamps (ако е включено EXTENDED_HISTORY)
$ cat ~/.zsh_history | grep "^:" | awk -F':' '{print strftime("%Y-%m-%d %H:%M:%S", $2), $NF}'
2024-03-15 02:33:11  rm -rf /Users/boss/Documents/Q4_Report/
2024-03-15 02:34:02  cp -r ~/Projects/secret_algo/ /Volumes/SANDISK/
2024-03-15 02:47:18  history -c   # опит за изчистване!

# Bash история
$ cat ~/.bash_history

# История на всички shells на системата
$ find /Users -name ".*_history" -type f 2>/dev/null | xargs ls -lah

# Last логин за всеки потребител
$ last
alex     ttys001  Fri Mar 15 02:28   still logged in
alex     ttys000  Thu Mar 14 23:44 - 02:28  (02:44)
reboot   ~        Thu Mar 14 22:01

# Детайлен login log
$ last -F | head -30   # -F = пълни timestamps

# Screen Time данни (Application usage)
$ sqlite3 ~/Library/Application\ Support/Knowledge/knowledgeC.db \
    "SELECT datetime(ZOBJECT.ZSTARTDATE + 978307200, 'unixepoch', 'localtime') as start,
     datetime(ZOBJECT.ZENDDATE + 978307200, 'unixepoch', 'localtime') as end,
     ZOBJECT.ZVALUESTRING as app
     FROM ZOBJECT
     WHERE ZOBJECT.ZSTREAMNAME = '/app/usage'
     ORDER BY ZOBJECT.ZSTARTDATE DESC LIMIT 40;"
2024-03-15 03:01:44 | 2024-03-15 03:12:22 | com.apple.Safari
2024-03-15 02:47:18 | 2024-03-15 03:01:44 | com.apple.Terminal
2024-03-15 02:31:02 | 2024-03-15 02:47:18 | com.apple.finder

# Кои устройства са използвали iCloud акаунта
$ defaults read MobileMeAccounts 2>/dev/null | grep "DeviceName\|AccountID"

# Clipboard история (ако е включена Universal Clipboard)
$ log show --predicate 'process == "pboard"' --last 24h --debug | head -20

#!/bin/bash
# forensics_collect.sh — събира всички артефакти наведнъж

OUTPUT=~/Desktop/forensics_$(date +%Y%m%d_%H%M%S)
mkdir -p $OUTPUT

echo "[*] Collecting system logs..."
sudo log collect --last 7d --output $OUTPUT/system.logarchive

echo "[*] Collecting Wi-Fi history..."
log show --predicate 'subsystem == "com.apple.wifi"' --last 7d \
    > $OUTPUT/wifi_history.txt

echo "[*] Collecting sudo usage..."
log show --predicate 'process == "sudo"' --last 30d --info \
    > $OUTPUT/sudo_history.txt

echo "[*] Collecting login records..."
last -F > $OUTPUT/login_history.txt

echo "[*] Collecting shell history..."
cp ~/.zsh_history $OUTPUT/zsh_history.txt 2>/dev/null
cp ~/.bash_history $OUTPUT/bash_history.txt 2>/dev/null

echo "[*] Collecting USB history..."
system_profiler SPUSBDataType > $OUTPUT/usb_current.txt

echo "[*] Collecting browser history..."
cp ~/Library/Safari/History.db $OUTPUT/safari_history.db 2>/dev/null
cp ~/Library/Application\ Support/Google/Chrome/Default/History \
    $OUTPUT/chrome_history.db 2>/dev/null

echo "[*] Collecting app usage (knowledgeC)..."
cp ~/Library/Application\ Support/Knowledge/knowledgeC.db \
    $OUTPUT/knowledgeC.db 2>/dev/null

echo "[✓] Done. Evidence collected in: $OUTPUT"
ls -lah $OUTPUT/