RECON LAB Manual
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Non-Binary Analysis
The Art of Mac Malware: Analysis p. wardle (The Art of Mac Malware) Volume 1: Analysis Chapter 0x5: Non-Binary Analysis Note: This book is a work in progress. You are encouraged to directly comment on these pages ...suggesting edits, corrections, and/or additional content! To comment, simply highlight any content, then click the icon which appears (to the right on the document’s border). 1 The Art of Mac Malware: Analysis p. wardle Content made possible by our Friends of Objective-See: Airo SmugMug Guardian Firewall SecureMac iVerify Halo Privacy In the previous chapter, we showed how the file utility [1] can be used to effectively identify a sample’s file type. File type identification is important as the majority of static analysis tools are file type specific. Now, let’s look at various file types one commonly encounters while analyzing Mac malware. As noted, some file types (such as disk images and packages) are simply the malware’s “distribution packaging”. For these file types, the goal is to extract the malicious contents (often the malware’s installer). Of course, Mac malware itself comes in various file formats, such as scripts and binaries. For each file type, we’ll briefly discuss its purpose, as well as highlight static analysis tools that can be used to analyze the file format. Note: This chapter focuses on the analysis of non-binary file formats (such as scripts). Subsequent chapters will dive into macOS’s binary file format (Mach-O), as well as discuss both analysis tools and techniques. 2 The Art of Mac Malware: Analysis p. -
Mac OS X Server Administrator's Guide
034-9285.S4AdminPDF 6/27/02 2:07 PM Page 1 Mac OS X Server Administrator’s Guide K Apple Computer, Inc. © 2002 Apple Computer, Inc. All rights reserved. Under the copyright laws, this publication may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, AppleScript, AppleShare, AppleTalk, ColorSync, FireWire, Keychain, Mac, Macintosh, Power Macintosh, QuickTime, Sherlock, and WebObjects are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, Extensions Manager, Finder, iMac, and Power Mac are trademarks of Apple Computer, Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Netscape Navigator is a trademark of Netscape Communications Corporation. RealAudio is a trademark of Progressive Networks, Inc. © 1995–2001 The Apache Group. All rights reserved. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. 062-9285/7-26-02 LL9285.Book Page 3 Tuesday, June 25, 2002 3:59 PM Contents Preface How to Use This Guide 39 What’s Included -
Apple Has Built a Solution Into Every Mac
Overview Mac OS X iPhone iPod + iTunes Resources Vision Mac OS X solutions VoiceOver from third parties. Browse the wide variety of To make it easier for the blind and those with low-vision to use a accessibility solutions supported computer, Apple has built a solution into every Mac. Called VoiceOver, by Mac OS X. Learn more it’s reliable, simple to learn, and enjoyable to use. In Depth Device Support Application Support Downloads VoiceOver Application Support VoiceOver. A unique solution for the vision-impaired. Every new Mac comes with Mac OS X and VoiceOver installed and includes a variety of accessible More than 50 reasons to use applications. You can also purchase additional Apple and third-party applications to use with VoiceOver. VoiceOver. Learn more While this page lists a few of the most popular applications, many more are available. If you use an application with VoiceOver that’s not on this list, and you would like to have it added, send email to [email protected]. Unlike traditional screen readers, VoiceOver is integrated into the operating system, so you can start using new accessible applications right away. You don’t need to buy an update to VoiceOver, install a new copy, or add the application to a “white list.” Moreover, VoiceOver commands work the same way in every application, so once you learn how to use them, you’ll be able to apply what you know to any accessible application. Apple provides developers with a Cocoa framework that contains common, reusable application components (such as menus, text fields, buttons, and sliders), so developers don’t have to re-create these elements each time they write a new application. -
Everything You Need to Know About Apple File System for Macos
WHITE PAPER Everything you need to know about Apple File System for macOS Picture it: the ship date for macOS High Sierra has arrived. Sweat drips down your face; your hands shake as you push “upgrade.” How did I get here? What will happen to my policies? Is imaging dead? Fear not, because the move from HFS+ (the current Mac file system) to Apple File System (APFS) with macOS High Sierra is a good thing. And, with this handy guide, you’ll have everything you need to prepare your environment. In short, don’t fear APFS. To see how Jamf Pro can facilitate seamless macOS High Sierra upgrades in your environment, visit: www.jamf.com • After upgrading to macOS High Sierra, end users will Wait, how did we get here? likely see less total space consumed on a volume due to new cloning options. Bonus: End users can store HFS, and the little known MFS, were introduced in 1984 up to nine quintillion files on a single volume. with the original Macintosh. Fast forward 13 years, and • APFS provides us with a new feature called HFS+ served as a major file system upgrade for the Mac. snapshots. Snapshots make backups work more In fact, it was such a robust file system that it’s been the efficiently and offer a new way to revert changes primary file system on Apple devices. That is all about to back to a given point in time. As snapshots evolve change with APFS. and APIs become available, third-party vendors will Nineteen years after HFS+ was rolled out, Apple be able to build new workflows using this feature. -
Policy and Procedures
Policy and Procedures PEER FORUM I: DISK IMAGING December 7-8, 2017 at The Museum of Modern Art The following notes came out of Peer Forum I: Disk Imaging, a discussion as part of the Media Conservation Initiative at MoMA. These notes represent the views of the speakers and participants who attended this meeting. The following notes came out of Peer Forum I: Disk Imaging, a discussion as part of the Media Conservation Initiative at MoMA. These notes represent the views of the speakers and participants who attended this meeting. Contributors Reinhard Bek, Conservator of Contemporary Art, Bek & Frohnert LLC Amy Brost, Assistant Media Conservator, The Museum of Modern Art Euan Cochrane (Speaker), Digital Preservation Manager, Yale University Library Eddy Colloton, Assistant Conservator specializing in Electronic Media, Denver Art Museum Deena Engel (Moderator), Clinical Professor, Director of the Program in Digital Humanities and Social Science; Department of Computer Science, Courant Institute of Mathematical Sciences, New York University Dragan Espenschied (Speaker), Preservation Director, Rhizome Patricia Falcão, Time-Based Media Conservator, Tate Jonathan Farbowitz, Fellow in the Conservation of Computer-Based Art, The Solomon R. Guggenheim Museum Briana Feston-Brunet, Variable Media Conservator, Hirshhorn Museum & Sculpture Garden Dan Finn, Media Conservator, Smithsonian American Art Museum Ben Fino-Radin, Founder, Small Data Industries Flaminia Fortunato, Andrew W. Mellon Fellow in Media Conservation, -
Episode Engine User’S Guide
Note on License The accompanying Software is licensed and may not be distributed without writ- ten permission. Disclaimer The contents of this document are subject to revision without notice due to con- tinued progress in methodology, design, and manufacturing. Telestream shall have no liability for any error or damages of any kind resulting from the use of this doc- ument and/or software. The Software may contain errors and is not designed or intended for use in on-line facilities, aircraft navigation or communications systems, air traffic control, direct life support machines, or weapons systems (“High Risk Activities”) in which the failure of the Software would lead directly to death, personal injury or severe physical or environmental damage. You represent and warrant to Telestream that you will not use, distribute, or license the Software for High Risk Activities. Export Regulations. Software, including technical data, is subject to Swedish export control laws, and its associated regulations, and may be subject to export or import regulations in other countries. You agree to comply strictly with all such regulations and acknowledge that you have the responsibility to obtain licenses to export, re-export, or import Software. Copyright Statement ©Telestream, Inc, 2010 All rights reserved. No part of this document may be copied or distributed. This document is part of the software product and, as such, is part of the license agreement governing the software. So are any other parts of the software product, such as packaging and distribution media. The information in this document may be changed without prior notice and does not represent a commitment on the part of Telestream. -
BLACKLIGHT 2020 R1 Release Notes
BlackLight 2020 R1 Release Notes April 20, 2020 Thank you for using BlackBag Technologies products. The Release Notes for this version include important information about new features and improvements made to BlackLight. In addition, this document contains known limitations, supported versions, and updated system requirements. While this information is complete at time of release, it is subject to change without notice and is provided for informational purposes only. Summary To enhance our forensic analysis tool, BlackLight 2020 R1 includes: • Apple Keychain Processing • Processing iCloud Productions obtained via search warrants from Apple • Additional processing of Spotlight Artifacts • Updated Recent Items parsing for macOS In Actionable Intel • Parsing AirDrop Artifacts • Updates to information parsed for macOS systems in Extended Information • Added support for log file parsing from logical evidence files or folders • Support added for Volexity Surge Memory images • Email loading process improved for faster load times • Support added for extended attributes in logical evidence files • Newly parsed items added to Smart Index (Keychain, Spotlight, and AirDrop) NEW FEATURES Apple Keychain Processing Keychains are encrypted containers built into macOS and iOS. Keychains store passwords and account information so users do not have to type in usernames and passwords. Form autofill information and secure notes can also be stored in keychains. In macOS a System keychain, accessible by all users, stores AirPort (WiFi) and Time Machine passwords. The System keychain does not require a password to open. Each user account has its own login keychain. By default, each user’s login keychain is opened with the user’s login password. While users can change this, most users do not. -
The Apple Ecosystem
APPENDIX A The Apple Ecosystem There are a lot of applications used to manage Apple devices in one way or another. Additionally, here’s a list of tools, sorted alphabetically per category in order to remain vendor agnostic. Antivirus Solutions for scanning Macs for viruses and other malware. • AVG: Basic antivirus and spyware detection and remediation. • Avast: Centralized antivirus with a cloud console for tracking incidents and device status. • Avira: Antivirus and a browser extension. Avira Connect allows you to view device status online. • BitDefender: Antivirus and malware managed from a central console. • CarbonBlack: Antivirus and Application Control. • Cylance: Ransomware, advanced threats, fileless malware, and malicious documents in addition to standard antivirus. • Kaspersky: Antivirus with a centralized cloud dashboard to track device status. © Charles Edge and Rich Trouton 2020 707 C. Edge and R. Trouton, Apple Device Management, https://doi.org/10.1007/978-1-4842-5388-5 APPENDIX A THe AppLe ECOSYSteM • Malware Bytes: Antivirus and malware managed from a central console. • McAfee Endpoint Security: Antivirus and advanced threat management with a centralized server to track devices. • Sophos: Antivirus and malware managed from a central console. • Symantec Mobile Device Management: Antivirus and malware managed from a central console. • Trend Micro Endpoint Security: Application whitelisting, antivirus, and ransomware protection in a centralized console. • Wandera: Malicious hot-spot monitoring, jailbreak detection, web gateway for mobile threat detection that integrates with common MDM solutions. Automation Tools Scripty tools used to automate management on the Mac • AutoCasperNBI: Automates the creation of NetBoot Images (read: NBI’s) for use with Casper Imaging. • AutoDMG: Takes a macOS installer (10.10 or newer) and builds a system image suitable for deployment with Imagr, DeployStudio, LANrev, Jamf Pro, and other asr or Apple Systems Restore-based imaging tools. -
Langley Aerospace Test Highlights 1990
Langley Aerospace 4" Test Highlights I _ r-4 r_ i-j S_ L_ .Z: i:" 7 >- t,/ ,. 1990 Langley Research Center NASA Technical Memorandum 104090 ORIGINAL PAGE AND Wt-fTTE _:"-_TO_PAPH Langley Aerospace Test Highlights 1990 National Aeronautics and Space Administration Langley Research Center Langley Research Center NASA Technical Memorandum 104090 Hampton, Virginia 23665-5225 k ¸ Foreword The role of the NASA Langley Research Center is to perform basic and applied research necessary for the advancement of aeronautics and spaceflight, to generate new and advanced concepts for the accomplishment of related national goals, and to provide research advice, technological support, and assistance to other NASA installations, other government agencies, and industry. This report highlights some of the significant tests that were performed during calendar year 1990 in the NASA Langley Research Center test facilities, a number of which are unique in the world. The report illustrates both the broad range of the research and technology activities at the NASA Langley Research Center and the contributions of this work toward maintaining United States leadership in aeronautics and space research. Other highlights of Langley research and technology for 1990 are described in Research and Technology 1990-- Lan,gley Research Center. Further information concerning both reports is available from the Office of the Chief Scientist, Mail Stop l OS-A, NASA Langley Research Center, Hampton, Virginia 23665 (804-864-6062). Richard H. Petersen Director °o° PRECEDING PAGE BLANK NOT FILMED 111 Availability Information For additional information on any highlight, contact one of the individuals identified with the highlight. This individual is either a member or a leader of the research group. -
2021-01-14-RECON-IMAGER-Manual.Pdf
MANUAL 1.Introduction 4 2. Version Comparisons 4 3. Supported Hardware 6 3.1 MODE A - SUPPORTED HARDWARE (Version 4.0.0) 6 3.2 MODE B - BOOT SUPPORTED HARDWARE (Version 5.0.0) 6 3.3 MODE C - SUPPORTED HARDWARE (Version 5.0.2 A1) 7 4. Before You Start 7 4.1 How Will You Process The Image? 7 4.2 What To Image? 8 4.3 What Image Format Should I Use? 8 5. Key Concepts To Understand 9 5.1 Apple File System (APFS) 9 5.2 Apple Extended Attributes 9 5.3 Fusion Drives 10 5.4 Core Storage 10 5.5 FileVault 11 5.6 T2 Security Chipset 11 5.7 Local Time Machine Snapshots (APFS) 12 5.8 Apple Boot Camp 12 6. Booting RECON IMAGER 13 6.1 Instant On - Portable Macs 13 6.2 Firmware Password 13 6.3 Connecting RECON IMAGER 14 6.4 Connecting Your Destination Drive 15 6.5 Starting RECON IMAGER 15 7. Using RECON Imager 17 7.1 Disk Manager 18 7.1.1 Refresh To Detect Changes 19 RECON IMAGER Copyright © 2010-2020 SUMURI LLC 1 of 59 7.1.2 Formatting a Collection Drive 20 7.1.3 Decrypting A FileVault Volume 22 7.1.4 System Date and Time 24 7.2 Disk Imager 24 7.2.1 Source 25 7.2.2 Image Type 25 7.2.3 Compression Options 27 7.2.4 Processing Local Time Machine Snapshots (APFS) 27 7.2.5 Destination 28 7.2.6 Image Name 28 7.2.7 Segment Size 29 7.2.8 Evidence Descriptor Fields 29 7.2.9 Hashing and Verification 30 8. -
Certif Ication Handbook
Certification Handbook EXAM FC0-U51 TM TM CompTIA® IT Fundamentals™ (Exam FC0-U51) CompTIA® IT Fundamentals™ (Exam FC0-U51) 2 Chapter # | Name of chapter CompTIA® IT Fundamentals™ (Exam FC0-U51) CompTIA® IT Fundamentals™ (Exam FC0-U51) Part Number: 099004 Course Edition: 1.0 Acknowledgements We wish to thank the following project team for their contributions to the development of this certification study guide: Pamela J. Taylor, Laurie A. Perry, Gail Sandler, Jason Nufryk, Alex Tong, and Catherine M. Albano. Notices DISCLAIMER While CompTIA Properties, LLC takes care to ensure the accuracy and quality of these materials, we cannot guarantee their ac- curacy, and all materials are provided without any warranty whatsoever, including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose. The name used in the data files for this course is that of a fictitious com- pany. Any resemblance to current or future companies is purely coincidental. We do not believe we have used anyone’s name in creating this course, but if we have, please notify us and we will change the name in the next revision of the course. Use of screenshots, photographs of another entity’s products, or another entity’s product name or service in this book is for edito- rial purposes only. No such use should be construed to imply sponsorship or endorsement of the book by, nor any affiliation of such entity with CompTIA Properties, LLC. This courseware may contain links to sites on the internet that are owned and operated by third parties (the “External Sites”). -
Using Apple Mail with Your Google Account
Setting Up Apple Mail for IMAP Access to Google Apps Note: To use a desktop client, you must first enable IMAP via the settings in the Web interface. For instructions, see Enable IMAP for Device Syncing under A Guide for Day One: Getting Started on the URI Google home page. You can set up your Apple Mail application to send and receive messages from your Google Apps for Education account. • Open the Mail app on your computer. • Select the Mail menu at the top, and then Preferences. If you are using Yosemite, the most recent operating system, choose Add Accounts. NOTE: If you are using an older operating system, you may need to choose either Preferences or Accounts. If Preferences, choose the Accounts option and then click the + button in the bottom corner. If you choose Accounts option under the Mail menu, click the + button in the bottom corner. A new window will open. ▪ Choose Google. ▪ Type your name. ▪ Type your full email address ([email protected]). ▪ Type your password. ▪ Click Set up. ▪ Make sure Mail is selected and click Done. Choosing Google as the account type will automatically select the correct IMAP and SMTP servers and ports for the application to use with the Google Apps email server. Google recommends the following settings for use with Apple Mail: ▪ From the Mail menu, click Preferences > Accounts > Mailbox Behaviors ▪ Store draft messages on the server > leave unchecked ▪ Store sent messages on the server > leave unchecked ▪ Store junk messages on the server > checked ▪ Delete junk messages when > Never ▪ Move deleted messages to the Trash mailbox > leave unchecked ▪ Store deleted messages on the server > leave unchecked .