Macintosh, OSX, & ios Forensics ITP 445 (3 Units)

Transcription

1 Macintosh, OSX, & ios Forensics ITP 445 (3 Units) Background Objective Apple Becomes World's Number One Smartphone Vendor in Q (businesswire.com) Apple has seen its PC market share expand from 9 percent to 15 percent in just four quarters HP and Apple will fight for top position in Q (Tim Coulling, Canalys Analysis) Once found only in classrooms and family rooms, Apple Inc. has seen significant growth with the launch of the iphone and ipad. As these mobile devices make their way into corporate offices across the globe they bring Apple OS X hardware with them. With 15% market share, Apple hardware and software is becoming a more frequent target of corporate, family, and law enforcement forensic investigations. Upon completing this course, students will: - Understand the fundamentals of computer forensics for OS X and ios systems - Understand the relationship between IT and forensics - Learn best practices for incident response of Apple hardware, software, and mobile devices including methods of acquisition - Be able to use the latest forensic tools to conduct OSX and ios investigations Prerequisites ITP 375 Instructor Pierson Clair Contacting the Instructor Office Hours TBA Lecture/Lab TBA Required Textbooks iphone and ios Forensics: Investigation, Analysis and Mobile Security. Andrew Hoog, Katie Strzempka. June ISBN: Website Mac OS X, ipod, and iphone Forensic Analysis DVD Toolkit. Kubasiak, Morrissey, Varsalone. December ISBN: All course material will be on Blackboard at blackboard.usc.edu

2 Grading Grading Scale Grading will be based on percentages earned in assignments. The scheduled class time will involve a combination of lectures and structured labs. Students are expected to spend time at home completing the assignments. Labs (4) Case Practical 1 10% Case Practical 2 15% Midterm 10% Final Paper/Presentation 20% Final Exam 25% Total 100% 20% (5% each) The following is the grading scale to be used for the final grades at the end of the semester 93% and above A 90% 93% A- 87% 90% B+ 83% 87% B 80% 83% B- 77% 80% C+ 73% - 77% C 70% 73% C- 67% 70% D+ 63% 67% D 60% 63% D- Below 60% F Policies - Projects turned in after the deadline will automatically have 5% deducted per day. Projects will not be accepted after 1 week beyond the project s deadline - No make-up exams (except for medical or family emergencies) will be offered nor will there be any changes made to the Final Exam schedule. - It is your responsibility to submit your project on or before the due date. It is not the responsibility of the lab assistant. Do not turn in anything to your lab assistant! - All projects will be digitally submitted through blackboard except where specifically specified. Always keep a backup copy of your labs - 2 -

3 Academic Integrity The use of unauthorized material, communication with fellow students during an examination, attempting to benefit from the work of another student, and similar behavior that defeats the intent of an examination or other class work is unacceptable to the University. It is often difficult to distinguish between a culpable act and inadvertent behavior resulting from the nervous tension accompanying examinations. When the professor determines that a violation has occurred, appropriate action, as determined by the instructor, will be taken. Although working together is encouraged, all work claimed as yours must in fact be your own effort. Students who plagiarize the work of other students will receive zero points and possibly be referred to Student Judicial Affairs and Community Standards (SJACS). Students with Disabilities All students should read, understand, and abide by the University Student Conduct Code listed in Scampus, and available at: Any student requesting academic accommodations based on a disability is required to register with Disability Services and Programs (DSP) each semester. A letter of verification for approved accommodations can be obtained from DSP. Please be sure the letter is delivered to me (or to your TA) as early in the semester as possible. DSP is located in STU 301 and is open 8:30 a.m. 5:00 p.m., Monday through Friday. The phone number for DSP is (213)

4 Macintosh, OSX, & ios Forensics ITP 499 (3 Units) Week 1 Forensic Review Course Outline Outline subject to change throughout the semester - Review of Forensic Methodologies - Review of Legal Requirements - Apple v Windows Reading: TBA Week 2 Introduction to Apple Hardware - Acquisition Methodologies - Apple Hardware - Partitions/HFS+/GUID/MBR - PowerPC & Intel Architecture - 32bit v 64bit Reading: Kubasiak Chapter 1 Assignment/Lab: Wireshark Packet Analysis of OSX System Week 3 Introduction of Apple Operating Systems - Leopard (10.5) - Snow Leopard (10.6) - Snow Leopard Server - Lion (10.7) - Lion Server - System 6, 7, 8, 9 - Time Stamps Readings: Kubasiak Chapter 2 Assignment/Lab: Basic OS Information Lab Week 4 Forensic Artifacts - Initial Triage - PLists - USB Connected Devices - Connected Network Devices - Print Spool Readings: Kubasiak Chapter 3 Assignment/Lab: Case Practical 1 Assigned - 4 -

5 Week 5 Securing Apple Systems - User Accounts - Firewall - Access & Network Controls - Sharing Reading: Kubasiak Chapter 4 Assignment/Lab: Image Recovery Lab Week 6 Introduction of Apple Software & Artificats - ilife Suite - iwork Suite - OS Applications (Mail, ical, Address Book, idvd, imovie) Reading: Kubasiak Chapter 5 Week 7 iphone/ipad Acquisition & Midterm review Week 8 MIDTERM - Versions - Contacts - SMS/MMS - Calendar - Applications Reading: Hoog Chapters 1 and 2 s.html Assignment/Lab: Case Practical 1 Due Week 9 Introduction of ios - Versions of ios - Contacts - SMS/MMS - Calendar - Apple Applications Reading: Hoog Chapters 3 and 4 Assignment/Lab: Introduce Final Paper Assignment (see week 14) Week 10 ios and Mac OSX Third Party Apps - Microsoft Office - Web Browsers (Firefox, Chrome, etc) - ios Applications Reading: Hoog Chapter 5, Kubasiak Chapter 6 Assignment/Lab: Case Practical 2-5 -

6 Week 11 Guest Lecture/Time Machine Analysis - Snow Leopard Time Machine - Lion Time Machine - Network Time Machine with a Time Capsule or Lion Server Reading: hine.html Week 12 Lion Server - Network Setup - Proper DNS Configuration - SMB - VPN - Firewall - Security Reading: TBA Assignment/Lab: Lion Server Lab Week 13 TBA Guest Lecture/Case & Lab Work Time Week 14 Final Paper Presentations Week 15 Conclusion The Final Paper assignment will allow students to gain a deeper technical understanding into a very specific part of either the Lion or Snow Leopard Operating System or a commonly installed Mac application. Alternatively an ios component may be selected. The selection will be approved by the Professor. Students may work individually or in pairs. If students elect to work in pairs, the work will be expected to be double an individual s effort. During week 14, the paper will be presented in class with individuals having up to 8 minutes to present their research and groups having up to 15 minutes to present their research. - Review for the final exam - Conclusion to the course - Completion of Case Practical 2 Final exam to be held on the date and time according to the schedule of classes, in the normal classroom - 6 -