macOS Forensics

#!/bin/bash
# macOS forensic triage collection
# Run with sudo on the compromised Mac or mounted image

TARGET="/"     # live system or set to mounted image path
OUT="/Volumes/EvidenceDrive/CASE-2026-009/$(hostname)"
mkdir -p $OUT/{logs,persistence,users,downloads}

# Unified Log (binary format — convert with 'log' command)
echo "Collecting Unified Log..."
# Export from running system:
log collect --last 7d --output $OUT/logs/unified-log.logarchive

# Or from offline mounted image:
# log show --archive $TARGET/var/db/diagnostics --info --debug \
#     --predicate 'subsystem == "com.apple.launchd"' \
#     > $OUT/logs/launchd.txt

# FSEvents (requires fseventer or dedicated parser)
echo "Collecting FSEvents..."
cp -R "$TARGET/.fseventsd/" "$OUT/logs/fseventsd/"

# LaunchAgents / LaunchDaemons (persistence)
echo "Collecting persistence..."
cp -R "$TARGET/Library/LaunchDaemons/" "$OUT/persistence/"
cp -R "$TARGET/Library/LaunchAgents/" "$OUT/persistence/system-launch-agents/"
for user_dir in $TARGET/Users/*/; do
    user=$(basename $user_dir)
    mkdir -p "$OUT/persistence/users/$user"
    cp -R "$user_dir/Library/LaunchAgents/" "$OUT/persistence/users/$user/" 2>/dev/null
done

# Quarantine database (downloaded files with URLs)
echo "Collecting quarantine events..."
for user_dir in $TARGET/Users/*/; do
    user=$(basename $user_dir)
    qdb="$user_dir/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"
    if [ -f "$qdb" ]; then
        cp "$qdb" "$OUT/downloads/QuarantineEvents-$user.db"
    fi
done

# User home artifacts
for user_dir in $TARGET/Users/*/; do
    user=$(basename $user_dir)
    mkdir -p "$OUT/users/$user"
    cp "$user_dir/.zsh_history" "$OUT/users/$user/" 2>/dev/null
    cp "$user_dir/.bash_history" "$OUT/users/$user/" 2>/dev/null
    cp -R "$user_dir/.ssh/" "$OUT/users/$user/" 2>/dev/null
done

LOGARCHIVE="/cases/CASE-2026-009/exec-mac/logs/unified-log.logarchive"

# Show all process launches in a time window
log show --archive $LOGARCHIVE \
    --start "2026-09-17 00:00:00" \
    --end "2026-09-17 06:00:00" \
    --predicate 'process == "launchd"' \
    --info | grep -i "spawn\|exec"

# Find network connections (endpointsecurity subsystem)
log show --archive $LOGARCHIVE \
    --predicate 'subsystem == "com.apple.endpointsecurity"' \
    --info | grep -i "connect\|bind"

# Find LaunchAgent installations (persistence events)
log show --archive $LOGARCHIVE \
    --predicate 'process == "launchd" AND message CONTAINS "LaunchAgent"' \
    --info

# Find app installations from DMG
log show --archive $LOGARCHIVE \
    --predicate 'process == "diskimagemounter"' \
    --info | grep -i "mount\|attach"

QDBPATH="/cases/CASE-2026-009/exec-mac/downloads/QuarantineEvents-jdoe.db"

# Query the quarantine database (SQLite)
sqlite3 $QDBPATH << 'EOF'
.headers on
.mode column
.width 30 15 50 30

-- All downloaded files with origin URLs
SELECT
    datetime(LSQuarantineTimeStamp + 978307200, 'unixepoch') AS DownloadTime,
    LSQuarantineAgentBundleIdentifier AS App,
    LSQuarantineDataURLString AS URL,
    LSQuarantineOriginURLString AS ReferrerURL
FROM LSQuarantineEvent
ORDER BY LSQuarantineTimeStamp DESC
LIMIT 100;
EOF
# Note: LSQuarantineTimeStamp is Apple Absolute Time (seconds since Jan 1 2001)
# 978307200 converts to Unix epoch