macOS Forensic Report

System Information

Hardware:

    Hardware Overview:

      Model Name: MacBook Pro
      Model Identifier: MacBookPro16,1
      Processor Name: 8-Core Intel Core i9
      Processor Speed: 2.3 GHz
      Number of Processors: 1
      Total Number of Cores: 8
      L2 Cache (per Core): 256 KB
      L3 Cache: 16 MB
      Hyper-Threading Technology: Enabled
      Memory: 32 GB
      System Firmware Version: 1715.60.5.0.0 (iBridge: 19.16.10072.0.0,0)
      OS Loader Version: 540.120.3~22
      Serial Number (system): C02ZK07HMD6N
      Hardware UUID: F48698B5-5C0E-5BAE-B3DF-275F58FB9D7B
      Provisioning UDID: F48698B5-5C0E-5BAE-B3DF-275F58FB9D7B
      Activation Lock Status: Enabled
            

macOS Version

ProductName:    macOS
ProductVersion: 14.3.1
BuildVersion:   23D60
            

Hostname

Forensic-Mac-Pro

Acquisition Summary

Acquisition performed by: forensic-admin

Tool version: macOS Forensic Acquisition Tool v1.1

Acquisition timestamp: 2025-04-01 14:30:26

Artifact Collection Statistics

Collection started: 2025-04-01T14:15:42.325612

Collection completed: 2025-04-01T14:28:37.981453

Duration: 775.66 seconds

Artifacts collected: 89

Artifacts failed: 7

Categories

Category	Description	Collected	Failed
System Information	Basic system information	6	0
File System	File system artifacts and metadata	10	2
User Data	User-specific data and configurations	38	3
System Security	Security-related artifacts	12	1
Network	Network configurations and connections	9	0
Running System	Currently running processes and services	14	1

Disk Image Information

Image File	Source	Size	SHA-256 Hash
disk0_20250401_143026.dd	/dev/disk0	500.28 GB	e7b834c239b4af7783d875e4a73c8f685a0f0b19c384248f97b7aeca7b535ce9

Collected Artifacts

System Information

Basic system information

Files & Directories

Commands

• system_profiler SPHardwareDataType > ./system_info.txt
• sw_vers > ./macos_version.txt
• hostname > ./hostname.txt
• whoami > ./current_user.txt
• date > ./acquisition_date.txt
• uptime > ./uptime.txt

File System

File system artifacts and metadata

Files & Directories

• /var/log/system.log
• /private/var/db/Spotlight-V100/
• ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2

Commands

• ls -la /Volumes/ > ./mounted_volumes.txt
• df -h > ./disk_usage.txt
• sudo find / -type f -mtime -7 -not -path '*/\.*' > ./recent_files_7days.txt

User Data

User-specific data and configurations

Files & Directories

• ~/Library/Preferences
• ~/Library/Application Support
• ~/Library/Logs
• ~/Library/Keychains/
• ~/Library/Messages/chat.db
• ~/Library/Safari/History.db
• ~/Library/Application Support/Google/Chrome/Default/History
• ~/Library/Mail
• ~/Library/Containers/com.apple.mail/Data/Library/Mail Downloads
• ~/Library/Calendars
• ~/Library/Accounts

Commands

System Security

Security-related artifacts

Files & Directories

• /Library/Application Support/com.apple.TCC/TCC.db
• /var/log/secure.log

Commands

• sudo log collect --last 24h --output ./security_logs.logarchive
• sudo pfctl -s rules > ./firewall_rules.txt
• security authorizationdb read system.preferences > ./system_auth.txt
• sudo launchctl list > ./launch_daemons.txt

Network

Network configurations and connections

Files & Directories

Commands

• ifconfig > ./network_interfaces.txt
• arp -a > ./arp_cache.txt
• netstat -an > ./network_connections.txt
• netstat -rn > ./routing_table.txt
• scutil --dns > ./dns_config.txt
• defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences > ./wifi_preferences.txt

Running System

Currently running processes and services

Files & Directories

Commands

• ps aux > ./running_processes.txt
• lsof > ./open_files.txt
• ls -la /Library/LaunchAgents/ /Library/LaunchDaemons/ ~/Library/LaunchAgents/ > ./launch_agents.txt
• kmutil showloaded > ./kernel_extensions.txt
• sysctl -a > ./system_control.txt

Preliminary Findings

The following notable items were observed during initial analysis:

• System last restarted: 2025-04-01 09:15:23 (5 hours prior to acquisition)
• User login history shows regular activity between 08:00-17:00 on weekdays
• Chrome browser history contains numerous visits to cloud storage services
• Several USB devices were connected in the past 30 days (see USB history for details)
• Network connections established to multiple external IP addresses

This is an automatically generated summary. Further analysis is recommended.