macOS Endpoint Investigation: Course Orientation Summary

What this module established

This module is orientation, and its subject is the platform rather than the course. Six readings, each one a thing a Mac does that a Windows host does not.

0.1, The doors already closed. Published best practice states an administrator's password is increasingly required to acquire a modern Mac, with an Intel machine lacking T2 and FileVault named as the likely exception. Apple Silicon will not boot external media unless it is Apple-signed. Data is encrypted at rest whether or not anybody enabled FileVault, with the key tied to an identifier inside the chip, so removing soldered storage collects ciphertext and leaves the key behind. An image can be hash-verified, technically complete and unreadable, which puts the credential question before the acquisition rather than inside it.

0.2, Capped by size, not by days. The log store is maintained by total folder size, around 520 to 530 MB across roughly fifty files, with no apparent way to change that allowance. So the window is a property of how fast a machine fills the space, and the counterintuitive result is that a busier machine keeps less. Published analysis states the thirty-day figure is largely incorrect. Measure the oldest surviving entry rather than quoting a number, and record the date you measured it.

0.3, The format decides the tool. Reading the format off a file precedes choosing a tool. A breadth pass maps where evidence lives and is not itself a finding, because a broad processor assumes formats, the platform reorganizes annually, and a store the parser cannot read is silently absent from an output that looks complete. Some stores have exactly one parser, which makes that project's maintenance part of your evidential capability.

0.4, Action is not intent. Tahoe 26 introduced a stream logging the exact text of menu selections with timestamps. Where a filesystem log records that a file was deleted, that stream records Move to Trash and then Empty Trash, which is a decision taken twice. Published testing states the artifact is not parsed by the most common commercial tools, so its absence from a processing run is evidence about your process. Clipboard history moved from memory to disk in the same release, and the same release removed visibility elsewhere.

0.5, Three limits, one final. Access answers to permission and encryption answers to a credential. Recording answers to nothing, because redaction in the logging system happens at write time rather than read time and the value is gone forever. The static message text survives and the interpolated value is what you needed. Enabling private data helps entries written afterwards and never reaches what is already on disk.

0.6, Weaken narrowly. A downloaded tool is blocked by a combination, the download attribute plus no usable signature, and the documented repair signs that one bundle and clears the attribute from that one application. The uncomfortable part is verified: a program fetched by a signed system transfer utility receives no attribute, and with the terminal holding full disk access the assessment will not block execution or warn. Those are the two things an analyst arranges deliberately, which is why isolation is the protection rather than configuration.

0.7, A command is a claim. The first commands you run are not lookups. Published description records that the ordinary log query excludes info and debug messages by default, so a search that found nothing established only that the default level holds nothing. A command addresses the running system unless pointed elsewhere, which on a workstation with an image mounted means the version, the hardware and the log can all describe your own machine while looking exactly like the subject's. Reading a subject's log from an image means assembling an archive from the uuidtext and diagnostics directories and adding an archive-version key, without which the system refuses it. The invocation, the target and the time all belong in the notes, because none of the three is recoverable from the output.

0.8, The second device on this disk. A Mac keeps a record of every device that trusted it. Published description records pairing records as written when somebody taps Trust, held at a defined path, and Apple's own guidance says trusted computers remain trusted unless the user revokes them or erases the device. Those records are also a capability, since practitioners use them to authenticate to a locked device, which makes finding one on the first day time-sensitive in a way nothing else in this module is. Backup catalog files name a device, its system version and its last backup date before anything is decrypted. Establishing the population early changes the scope, the requests and how any synced artifact is read.

What comes next

Module 1 covers the macOS security model and the threat landscape it was built against. Everything this module treated as a constraint is produced by that machinery: the assessment that refused your tool, the privacy layer that decides what a process may read, the integrity protection that closes a path to root, and the signing chain behind all three.

The habit to carry forward is the one 0.1 and 0.5 share. Establish what is foreclosed and state it early, because a constraint recorded at the point you found it is a scope statement and the same constraint recorded at the end reads as an apology.