# Linux and Mac Forensics

> Chapter 8 of the Courseiva EC-CHFI curriculum — https://courseiva.com/learn/ec-chfi/linux-and-mac-forensics

**Official objective:** 5.2 — Apply forensic analysis techniques to Linux and Mac OS environments.

## Introduction

For the 312-49 exam objective 5.2, you must apply forensic analysis techniques to Linux and Mac OS environments. This concept matters because real-world investigations often involve suspects who use Macs at home or Linux servers in a data centre, and if you only know Windows forensics, you will miss critical evidence — or, worse, accidentally destroy it. Understanding how to examine these systems means you can recover hidden files, analyse system logs, and prove what a user did, even if they tried to cover their tracks.

## The Missing Piece of a Jigsaw Puzzle Analogy

Have you ever been halfway through a 2,000-piece jigsaw puzzle of a busy city scene, only to realise one piece is missing? That piece isn't random — it's the one that shows the exact spot where a street meets a corner shop. Without it, the whole picture feels wrong, and you can't be certain what's really going on in that part of the city.

In the digital world, Linux and Mac operating systems are like that missing puzzle piece when you are investigating a crime. Most evidence lives on Windows computers — the bulk of the puzzle is there, clear and easy to see. But if a suspect used a Linux server or a Mac laptop, you cannot just ignore that piece. You have to find it, understand its shape, and fit it exactly into the picture. Unlike Windows, Linux and Mac don't leave the same kinds of tracks. They use different file systems (the way they store files), different log locations (where they record events), and different commands to recover deleted data. If you use Windows-only tools on a Mac, you will miss key evidence or even corrupt it.

This analogy works because, like the missing puzzle piece, Linux and Mac forensics is not optional — it is essential to complete the whole investigation. The piece is shaped differently, so you need a different technique to handle it, but once you do, the full scene becomes clear.

## Core explanation

To do forensics on Linux and Mac, you first need to understand what makes them different from Windows. A forensic investigation is the process of finding, preserving, and analysing evidence from a computer to understand what happened, when, and who did it. On Windows, evidence like file access times, user login records, and deleted files are stored in well-known places with standard tools. Linux and Mac are different because they are built on Unix, a family of operating systems that use a different philosophy for organising data.

Let us start with the most basic difference: the file system. A file system is the method an operating system uses to store and organise files on a hard drive. Windows uses NTFS (New Technology File System). Linux commonly uses ext4 (fourth extended file system) or XFS. Mac uses APFS (Apple File System) or older HFS+ (Hierarchical File System Plus). Each of these file systems stores metadata — data about data — differently. For example, the creation time of a file (when it was first made) is recorded differently in APFS than in ext4. If you use a Windows forensic tool on an APFS drive, you might read the wrong field and get the wrong timestamp, ruining your timeline of events.

Next, consider user accounts and permissions. Both Linux and Mac are multi-user systems, meaning more than one person can use the same computer, and each user has a unique identifier (UID). When a user logs in, the system records that event in log files. On Linux, these logs are typically stored in the /var/log directory. Key log files include:

- /var/log/auth.log (records authentication events like logins and sudo commands)
- /var/log/syslog (general system messages)
- /var/log/kern.log (kernel messages, including hardware issues)

On Mac, logs are managed by the unified log system, which collects data from across the system into a binary format. To read them, you need the 'log' command in Terminal (a command-line interface). A common mistake beginners make is to look for /var/log/auth.log on a Mac — it does not exist there by default. The Mac stores log data in a database at /var/db/diagnostics/PubSub/ and you must use the command 'log show' to extract it.

Deleted file recovery is another critical area. When you delete a file on Linux, the file system simply marks that space as available for reuse — the data remains on the drive until overwritten. Forensic investigators use tools like 'foremost', 'scalpel', or 'testdisk' to carve out this data by looking for file headers (the unique signature at the start of a file, such as 'JFIF' for JPEG images). On Mac, the Trash (called .Trashes) actually moves files to a hidden folder instead of deleting them immediately. You can recover these files by mounting the drive and looking at the .Trashes directory of each user.

Memory forensics is also distinct. RAM (Random Access Memory) contains running processes, network connections, and even decrypted passwords. On Linux, you can capture a memory dump using 'lime' (Linux Memory Extractor). On Mac, you might use 'osxpmem'. This memory dump can then be analysed with a tool like 'volatility' to see what programs were running at the time of seizure.

Finally, encryption is a big challenge. Linux uses LUKS (Linux Unified Key Setup) for full-disk encryption, while Mac uses FileVault. If the suspect has locked their drive with a password and you do not have it, you will not be able to access the data without bypassing the encryption, which is extremely difficult. In those cases, you might try to capture the system while it is running (live forensics) to get the decryption key from memory.

In summary, Linux and Mac forensics requires specialised knowledge because the storage structures, log systems, and recovery methods are all different from Windows. The 312-49 exam expects you to know the exact commands and locations for each OS, not generic principles.

## Real-world context

An IT professional working as a forensic investigator for a mid-sized company might receive a call from HR: an employee is suspected of leaking sensitive client data to a competitor. The employee uses a MacBook Pro issued by the company, but also has a personal Linux server at home that they occasionally use for work.

The investigator needs to approach this step by step. First, they must preserve the evidence. They cannot just turn on the Mac and start clicking — that would change timestamps and possibly overwrite deleted files. Instead, they create a forensic image, which is an exact bit-for-bit copy of the hard drive. On a Mac, they would boot the machine into Target Disk Mode by holding the T key during startup. This makes the Mac act like an external hard drive. Then they connect it to a forensic workstation and use a tool like 'dd' (a command-line data duplicator) to copy the drive. The command might look like:

- dd if=/dev/disk2 of=/evidence/mac_image.dd bs=512 conv=noerror,sync

This reads from the disk (if=input file) and writes to an image file, ignoring read errors. The 'bs=512' sets the block size, and 'conv=noerror,sync' ensures the copy continues even if there are bad sectors.

Once they have the image, they analyse it. They mount the image read-only so nothing gets changed. On a Mac file system (APFS), they use a tool like 'apfs-fuse' or commercial software like BlackBag. They look for:

- The user's home folder (/Users/suspectname/) for documents, downloads, and screenshots.
- The .Trashes folder for recently deleted files.
- The Safari or Chrome browser history to see if the user uploaded files to a cloud service.
- The unified logs using 'log show --style compact --predicate 'eventMessage contains "upload"'' to search for upload-related events.

The Linux server is trickier. The investigator cannot just image it if it is running — they need to perform live forensics. They SSH (secure shell) into the server as root (the administrative user) and run commands to capture volatile data, which is data that disappears when the power goes off. They collect:

- The output of 'netstat -an' to see active network connections.
- The current process list using 'ps aux'.
- The bash history for each user from ~/.bash_history.
- They also dump memory using 'lime'.

After imaging both machines, the investigator cross-references findings. The Mac logs show the employee emailed a ZIP file to a personal address at 3:00 AM. The Linux server logs show that same ZIP file was downloaded and extracted at 3:30 AM. The file names match. This chain of evidence proves the data transfer.

The investigator then writes a report summarising their methodology, the tools used, and the findings. They must be careful to explain why they used Linux-specific commands and Mac-specific log extraction, because a non-technical manager or lawyer might not understand why they did not just 'check the recycle bin'.

## Exam focus

The 312-49 exam tests Linux and Mac forensics in a specific, predictable way. You will see multiple-choice questions that ask you to identify the correct command, log file location, or tool for a given scenario. Here is exactly what they focus on:

- Log file locations: You must memorise which log files exist on Linux vs Mac. A typical question: 'Where are authentication logs stored in a standard Linux system?' The answer is /var/log/auth.log. On Mac, the exam will ask about the unified log system and the 'log show' command.
- File system types: The exam loves to test which file system is used by which OS. Expect questions like: 'Which file system is native to macOS?' The answer is APFS (or HFS+ for older systems). For Linux, expect ext4, XFS, or Btrfs.
- Forensic imaging commands: Know the 'dd' command syntax. The exam will test your understanding of parameters like bs (block size), conv (conversion options), and of (output file). They might ask: 'Which dd option prevents the imaging process from stopping on read errors?' Answer: conv=noerror.
- Memory forensics tools: You need to know that 'lime' is for Linux memory acquisition and 'volatility' is for analysis of both Linux and Mac memory dumps. The exam might ask: 'Which tool is used to capture volatile memory from a Linux system?' Answer: LiME.
- Mac-specific features: Questions often cover Target Disk Mode, FileVault encryption, and the unified log system. Expect a question: 'How do you boot a Mac into Target Disk Mode?' Answer: Hold the T key during startup.
- Deleted file recovery: The exam tests tools like 'foremost' and 'scalpel'. A typical trap question: 'Which tool can recover deleted files based on file headers?' The correct answer is 'foremost' (or 'scalpel', depending on the options listed).
- Common traps: The exam loves to include Windows pathways in the answer choices to confuse you. For example, they might list 'C:\Windows\System32\config' as a Linux log directory. Do not fall for it. Another trap is mixing up HFS+ and APFS — remember that HFS+ is older and APFS is the current standard on Mac.
- Commands to memorise:

- 'ls -la' to list files with permissions.
- 'sudo' to run commands as root.
- 'dmesg' to view kernel messages.
- 'fdisk -l' to list disk partitions.
- 'strings' to extract readable text from binary files.

The exam will also test your understanding of permissions: read (r), write (w), execute (x) for owner, group, and others. A question might give you 'chmod 755' and ask what it does. You need to know that 755 means owner can read/write/execute, group and others can read/execute.

Finally, the exam expects you to know that Mac is based on a Unix-like kernel called XNU, which means many Linux forensic principles also apply to Mac — but with different tool names and log locations. Do not assume that a Linux command works exactly the same on Mac; they sometimes have different flags.

## Step by step

1. **Preserve Volatile Data** — If the Linux or Mac system is running, collect volatile data first. On Linux, run 'w' to see logged-in users, 'netstat -an' for network connections, and 'ps aux' for running processes. On Mac, use the same commands but also dump memory with 'sudo lime' or 'osxpmem'. This data will be lost on shutdown.
2. **Shut Down and Image the Drive** — Power off the system safely to preserve the hard drive. On a Mac, boot into Target Disk Mode (hold T) and connect to a forensic workstation. On Linux, remove the drive and connect it to a write-blocker (a hardware device that prevents any writes to the drive). Use 'dd' to create a bit-for-bit copy: 'dd if=/dev/sda of=/evidence/image.dd bs=512 conv=noerror,sync'.
3. **Mount the Image Read-Only** — Mount the forensic image as read-only so you do not modify it. For Linux images, use 'mount -o loop,ro /evidence/image.dd /mnt/forensic'. For Mac APFS images, use a tool like 'apfs-fuse' with the read-only flag. This step ensures the evidence remains unaltered during analysis.
4. **Analyse the File System** — Navigate the mounted image. Look for user home directories (/home/ on Linux, /Users/ on Mac). Check for hidden files (prepended with a dot, e.g., .bash_history). Examine the Trash folders. Run 'ls -la' to see file permissions and timestamps. Compare timestamps with logs to build a timeline.
5. **Extract and Analyse Logs** — On Linux, copy log files from /var/log/ to your analysis environment. Search for relevant events using 'grep'. On Mac, use 'log show --style compact --last 1d' to extract the last day of logs. Look for log entries that match suspicious file activity, such as file uploads or unusual SSH connections.
6. **Recover Deleted Files** — Use forensic carving tools like 'foremost' on the entire image. Run 'foremost -i /evidence/image.dd -o /evidence/carved'. This will scan the image for file headers and recover files that still reside in unallocated space. Document all recovered files and their original file paths if possible.
7. **Document and Report** — Write a detailed forensic report including the steps taken, commands used, tools used, and findings. Include screenshots of key logs and recovered files. Explain why each step was performed and any deviations from standard procedure. This report must be clear enough for a non-technical audience (lawyers, managers) to understand.

## Comparisons

### Linux Log System vs Mac Unified Log System

**Linux Log System:**
- Logs are plain text files stored in /var/log/
- Logs are separated by service (auth.log, syslog, kern.log)
- Analyse with standard Unix tools like grep and cat

**Mac Unified Log System:**
- Logs are stored in a compressed, binary database
- All logs are combined into a single unified store
- Must use the 'log' command with predicates for extraction

### ext4 (Linux File System) vs APFS (Mac File System)

**ext4 (Linux File System):**
- Journaling file system for reliability
- Supports large file sizes up to 16 TB
- No native support for snapshots in default configuration

**APFS (Mac File System):**
- Copy-on-write file system for data integrity
- Native support for snapshots and space sharing
- Uses a different metadata structure for timestamps

### LiME (Linux Memory Acquisition) vs osxpmem (Mac Memory Acquisition)

**LiME (Linux Memory Acquisition):**
- Loadable kernel module that dumps RAM to disk
- Supports Linux kernel versions 2.6.x to 5.x
- Output format compatible with Volatility 2 and 3

**osxpmem (Mac Memory Acquisition):**
- User-space tool that accesses memory via /dev/mem
- Designed for macOS 10.9 and later
- Output format compatible with Volatility 2 and 3

### LUKS (Linux Full Disk Encryption) vs FileVault (Mac Full Disk Encryption)

**LUKS (Linux Full Disk Encryption):**
- Uses a master key encrypted with multiple passphrases
- Encrypts entire block device, including system files
- Can be decrypted with the passphrase or recovery key

**FileVault (Mac Full Disk Encryption):**
- Uses XTS-AES-128 encryption with a user's login password
- Encrypts the boot volume, but not external drives by default
- Can be unlocked with the user's password or recovery key from iCloud

## Diagram

_Flowchart showing the steps in Linux and Mac forensic investigation: from initial response to report writing._

```mermaid
flowchart TD
    A[Crime Reported] --> B{System Running?}
    B -- Yes --> C[Collect Volatile Data: memory, processes, connections]
    C --> D[Shut Down System]
    B -- No --> D
    D --> E[Image Hard Drive with dd / write-blocker]
    E --> F[Mount Image Read-Only]
    F --> G{OS Type?}
    G -- Linux --> H[Analyse ext4 file system, /var/log/ logs]
    G -- Mac --> I[Analyse APFS file system, unified logs via log show]
    H --> J[Carve deleted files with foremost]
    I --> J
    J --> K[Correlate evidence: timeline, user activity]
    K --> L[Write Report]
```

## Common misconceptions

- **Misconception:** Linux and Mac forensics are the same because both are Unix-based, so you can use the same commands and tools. **Reality:** Mac uses a different file system (APFS) and a unified log system, while Linux uses ext4 and syslog. Commands like 'log show' are Mac-specific, and tools like 'dd' have different options. You must treat them separately. (Beginners hear 'Mac is Unix-based' and assume it is identical to Linux. In reality, Apple heavily customised the system, especially for logging and encryption.)
- **Misconception:** Deleted files on Linux are permanently gone if the Trash has been emptied. **Reality:** When you delete a file on Linux, only the pointer to the data is removed, not the data itself. The data remains on the drive until it is overwritten. Tools like 'foremost' can recover it. (This mistake comes from experience with Windows, where the Recycle Bin gives a visible second chance. On Linux, the command 'rm' removes files without a visual trash, leading people to think it is permanent.)
- **Misconception:** You can safely turn on a Mac or Linux computer to collect evidence, just like you would with a Windows PC. **Reality:** Turning on a computer can alter evidence — timestamps get updated, temporary files are created, and running processes may overwrite deleted data. You should always create a forensic image of the powered-off drive first, or perform live forensics if the machine is already running. (TV shows show investigators casually logging into a suspect's computer. In reality, booting a system changes hundreds of files immediately, which can destroy evidence and compromise the chain of custody.)
- **Misconception:** If you know Windows forensics, you can easily adapt to Linux and Mac by just knowing a few commands. **Reality:** The entire forensic process is different — from the file system structure to the way logs are stored to the tools used for analysis. You need dedicated training and hands-on practice with each OS to avoid corrupting evidence. (There is a belief that 'operating systems are basically the same under the hood'. In forensics, the differences in metadata storage and logging are critical, and assuming similarity leads to mistakes that can ruin a case.)

## Key takeaways

- Linux uses ext4, XFS, or Btrfs file systems, while Mac uses APFS or HFS+; never use Windows tools to image these drives.
- Authentication logs on Linux are stored in /var/log/auth.log, while Mac uses a unified log system accessible with the 'log show' command.
- Deleted files on both Linux and Mac can be recovered using tools like 'foremost' and 'scalpel' because the data remains on the drive until overwritten.
- Memory on Linux is captured with LiME and analysed with Volatility; on Mac, use osxpmem for capture and Volatility for analysis.
- Mac Target Disk Mode (hold T during startup) allows forensic imaging without booting the OS, preserving evidence integrity.
- Full-disk encryption (LUKS on Linux, FileVault on Mac) requires the password or a memory dump to decrypt; live forensics is essential if the system is running and encrypted.

## FAQ

**Can I use Windows forensic tools on a Mac hard drive?**

No, standard Windows forensic tools do not understand Mac file systems like APFS or HFS+. You need specialised tools like MacQuisition or open-source tools like 'apfs-fuse' to read Mac drives correctly.

**What is the difference between 'dd' and 'dcfldd' in Linux forensics?**

'dd' is the basic Unix imaging tool, while 'dcfldd' is a forensic version that shows progress and can compute hashes (like MD5) on the fly. For the exam, know both, but 'dd' is more commonly tested.

**How do I find the bash history of a user on Linux?**

The bash history is stored in a hidden file in each user's home directory: /home/username/.bash_history. You can view it with 'cat /home/username/.bash_history' or 'strings' if the file is binary.

**What is the unified log on Mac and why is it different?**

The unified log is Apple's modern logging system that collects data from the kernel, apps, and system services into a single compressed database. Unlike Linux, you cannot just read plain text files — you must use the 'log' command to query it.

**If a Linux system uses LUKS encryption, can I still image the drive?**

You can image the encrypted drive, but the data will be encrypted and unreadable without the decryption key. You must either get the password, capture the decryption key from memory (live forensics), or attempt to crack the passphrase.

**What is Target Disk Mode on a Mac?**

Target Disk Mode makes a Mac behave like an external hard drive when connected to another Mac via Thunderbolt or FireWire. It allows forensic imaging without booting the Mac's operating system, preserving evidence.

## Check your understanding

1. **Which Mac boot mode allows a forensic investigator to image the hard drive without booting the operating system?**

   Answer: Target Disk Mode, activated by holding the T key during startup.

2. **What is the command to capture a forensic image of a Linux drive using dd, ensuring the process does not stop on read errors?**

   Answer: dd if=/dev/sda of=image.dd bs=512 conv=noerror,sync

3. **Where are authentication logs stored by default on a standard Linux system?**

   Answer: In /var/log/auth.log

4. **Which tool is used to recover deleted files from a Linux file system by searching for file headers?**

   Answer: foremost (or scalpel)

5. **On a Mac running macOS 10.13 or later, what is the native file system?**

   Answer: APFS (Apple File System)

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-chfi/linux-and-mac-forensics