Examining information by dynamic analysis on macOS-based personal computers

In brief

A practical guide: how on macOS to extract and brute force the account password in order to reach the keychain, tokens and desktop messengers dynamically. Static analysis is the "gold standard", but it misses protected memory areas. The talk is methodological: the Mobile Criminalist line is assessed critically.

Key points

• A digital forensics specialist, 8 years of computer forensic examinations.
• Static analysis (immutability, an exact sector-by-sector copy, analysis, interpretation) — the "gold standard", but it misses protected memory areas.
• On Windows the procedure is established: the hash out of the registry ("weak cryptographic strength") → brute force → virtualization of the copy; along the way browsers and tokens.
• macOS — a proprietary OS and file system; keys and passwords in the Keychain, access by password or biometrics, an analogue of Windows DPAPI. Settings and accounts — in plists, binary by default: more compact and faster than XML.
• The route to the hash: dslocal (a separate binary file per user, named after the user) → ShadowHashData → conversion to XML with the plutil utility → Base64.
• The macOS hash is PBKDF2-SHA512: the entropy (the final result, in hexadecimal form), the iterations and the salt (a unique sequence of bytes); the password fits when the entropies match. By contrast: the Windows NT hash, with no salt and no iterations, based on the outdated MD4 — a brute force speed that is "very high".
• The hash is prepared with special scripts (into the hashcat format); Mobile Criminalist Expert, according to the speaker, does not convert the macOS hash ("maybe they've fixed it by now"), while an unnamed third-party tool displayed the hash incompletely — a brute force is impossible.
• In hashcat — mode 7100, by mask or by dictionary; MK Brute Force (a front end built on hashcat) does not support it. A GPU cluster is better: the brute force "can run into years", custom dictionaries built from the owner's notebooks and devices are needed; wikpass.com is recommended.
• After the password — virtualization of the copy or an examination with changes made (in a forensic examination only with the initiator's permission, Article 57); the keychain, tokens and passwords are decrypted; desktop messengers are taken by Mobile Criminalist Scout. Tool code does contain bugs — double-check manually.

Tools, artifacts, technologies

• Keychain — macOS keys and passwords, an analogue of Windows DPAPI; plist — settings and accounts (XML / binary / JSON).
• dslocal → ShadowHashData → plutil → Base64 — the route to the hash; PBKDF2-SHA512 — the hash itself.
• hashcat — mode 7100; MK Brute Force — a front end built on hashcat, does not support 7100; special scripts — prepare the format.
• Mobile Criminalist Expert — does not convert the macOS hash; Mobile Criminalist Scout — messengers, tokens, browser passwords; the unnamed tool loses part of the hash.
• wikpass.com — dictionaries (the domain is by ear); Fusion Drive, Secure Enclave — from the Q&A; virtualization of the object — working on an exact copy.

Legal and organizational context

The terminology is "forensic examination", "the initiator of the examination". Article 57: a forensic expert is not entitled to use methods that could cause the full or partial destruction of the object or a change in its main properties and appearance (the code is not specified). Hence an examination with changes made — only with the initiator's permission. The speaker is from the Forensic Expert Centre of the Investigative Committee of Russia (SEC SK); there are no references to departmental methodologies or to regulators.

Questions from the audience

• "Yuri Mikhailovich" (named by the moderator, by ear): "So the disk wasn't encrypted? How did you pull the file out?" → It was a Fusion Drive, they managed to reassemble it and pull the data out; if you decrypt the disk, you get the password as well.
• The second question (the person asking is not named): can the account plist on macOS be read under a user account, unlike shadow on Linux? and on a "live" system? → There are difficulties: hardware encryption, the Secure Enclave, nothing without root; with full access to the file system the plist can be pulled out. "There are a lot of problems with Apple devices."
• There were no more questions — the moderator closed the section.

The speaker's position

The tone is that of a lecture and a methodological guide, with no polemics and no sales pitch. He treats as correct the priority of static analysis, manual double-checking and the initiator's permission before changes are made; as a problem — blind trust in automation. He admits the limitations openly: hardware encryption, the Secure Enclave, root, the difficulty of modern iPhones, the dependence on whether the plist can be pulled out.

Quotes

• "Overall, static analysis is the gold standard of digital forensics."
• "The salt prevents, for example, the use of rainbow tables."
• "One of them is MK Brute Force. An excellent program, it's developing, a lot is being added. Unfortunately, at the moment it doesn't support the 7100 password guessing mode."
• "…you have to keep in mind that software tools can make mistakes, that is, their code may contain bugs."