Investigate macOS disk images using Autopsy, mac_apt, and SQLite to identify and extract hidden data potentially concealed with steganography.

Autopsy, FTK Imager, db browser for SQLite, steghide, mac_apt

Q1:What version of macOS is running on this image?

Investigation Steps:

1. Image Mounting and Exploration: Used FTK Imager to mount and explore the forensic image. This allowed for a structured view of the nested file system and evidence files.
2. File System Navigation: Navigated to the core system configuration directory located at /System/Library/CoreServices/ within the mounted volume.
3. Artifact Identification: Located and inspected the SystemVersion.plist file, which contains essential metadata about the operating system's version and build.
4. Data Extraction: Leveraged the built-in text viewer in FTK Imager to read the XML content of the .plist file. Under the ProductUserVisibleVersion and ProductVersion keys, the specific version number was identified.

Answer: 10.15

Press enter or click to view image in full size

Q2:What “competitive advantage” did Hansel lie about in the file AnotherExample.jpg? (two words)

Investigation Steps:

1. Directory Analysis: Using FTK Imager, I explored the /Users/Shared/ directory within the forensic image to search for relevant media or document files.
2. File Discovery: Identified a suspicious image file titled AnotherExample.jpg alongside a plain text file named secret.
3. Data Correlation: Upon viewing the content of the secret file in the preview pane, it was found to contain a marketing-style claim about a new device.
4. Evidence Extraction: The text explicitly mentions a specific technology as a “competitive advantage” that was being lied about or kept secret.

Answer: flip phone

Press enter or click to view image in full size