Episode 128: APOLLO and Forensic Analysis, with Sarah Edwards

Synopsis:

Sarah Edwards joins the pod to talk all about APOLLO with Marcus, Charles and Tom, and about all the challenges of forensics and security on the macOS and iOS platforms.

Your Hosts:

  • Tom Bridge, Partner, Technolutionary LLC [@tbridge777]
  • Marcus Ransom, Senior Apple Systems Engineer, CompNow [@marcusransom]

Our Guest:

  • Sarah Edwards, Mobile Forensic Engineer & Author/Instructor at SANS Institute, [@iamevltwin]

Presenting Sponsor: VMware Workspace ONE

VMware Workspace ONE empowers you with full macOS lifecycle management. Get past the hassles of legacy imaging with faster modern onboarding. Easily deliver all your native Mac app packages as well as SaaS and virtual Windows apps, and empower users with one-click single sign on. Stay on top of your security needs with complete encryption management and rich conditional access. The recognized industry leading unified endpoint management solution is your one stop for all Apple devices and apps. Learn more at www.workspaceone.com

Listen!

Links & Notes

Apollo
Apollo releaseWired Article: https://www.wired.com/story/cellebrite-ufed-ios-12-iphone-hack-android/
NSKeyedArchiver
Protocol Buffers
Protobuf
Apple’s ‘Find My’ Feature uses some very clever crypto

Supporting Sponsors

Thanks to new sponsor cmdReporter for sponsoring the Mac Admins Podcast!

MacStadium

Use code MACADMINS at checkout, good for 50% off your first month of a Mac mini subscription!

Patreon Sponsors

The Mac Admins Podcast has launched a Patreon Campaign! Our named patrons this month include Randy Wong, Chad Swartwout, William Smith, Justin Holt, Weldon Dodd, Jon Brown, Randy Wong, Dan Collings, Jason Dettbarn and Seb Nash. Thanks everyone!

Mac Admins Podcast Community Calendar, Sponsored by Watchman Monitoring

Conference Sites
Event NameLocationDatesCost
MacAdmins ConferenceState College, PA9-12 July 2019$649 Early Bird until 13 May
MacSysAdminGöteborg, Sweden1-4 October 201911700 SEK
MacTech ConferenceLos Angeles, CA15-18 October 2019$999 Early Bird til 28 June
Jamf Nation User ConferenceMinneapolis, MN12-14 November 2019$799 Early Bird Rate ($699 for EDU)
Meetups
Event NameLocationDatesCost
Houston Apple AdminsSaint Arnold Beer Garden17 July 2019, 5:30 p.m. CTFree
Apple Admins of Seattle and the Great NorthwestFred Hutch18 July 2019, 6.00 p.m. PTFree
Los Angeles Mac AdminsBroadcom, 15101 Alton Pkwy, Irvine, CA 9261824 July 2019, 5:00 p.m. PTFree
Apple Admins of Seattle and the Great NorthwestTBD15 August 2019, 6.00 p.m. PTFree
Apple Admins of Seattle and the Great NorthwestTBD19 September 2019, 6.00 p.m. PTFree

Rate Us On iTunes!

Rate Us On Apple Podcasts!

Sponsor Mac Admins Podcast!

If you’re interested in sponsoring the Mac Admins Podcast, please email podcast@macadmins.org for more information.

Social Media

Get the latest about the Mac Admins Podcast, follow us on Twitter! We’re @MacAdmPodcast!

Episode 52: Digital Forensics on the Mac with Sarah Edwards

Mac Admins Podcast, Episode 52: Digital Forensics on the Mac with Sarah Edwards

Synopsis

Sarah Edwards joins us to talk about Digital Forensics on the Mac, and using system tools, special software, and all kinds of other cool tools to do forensic research on iOS devices and Macs.

Your Hosts:

Guests

Sponsored by Jamf

Jamf Now

Mac Admins Podcast listeners can get started today — by setting up the first 3 devices for free. Add more, for just two bucks a month, per device. Create your free account today at jamf.com/macadmins.

Listen!

Links & Notes

Mac 4n6 Blog
Location scraper
MacMRU Parser

Five Dollar Wrench

iP Box

MacQuisition

SleuthKit

iExplorer

OpenBSM Auditing on macOS

OpenBSM article in MacTech (from Rich Trouton)

iOS Frequent Locations Dumper

HFSPlus Resources

Chicago Tribune

Stanford Heart Research

iTunes Information

Qi Charging

Community Calendar, Sponsored by Watchman Monitoring

Call for Presenters

Mac AD UK in Leicester Square, February 20-21, 2018

Conference Sites


Macsysadmin in Gothenburg, Sweden October 3-6 2017
JNUC in Minneapolis, MN October 24-26, 2017
MacTech Conference in Los Angeles, CA on November 15-17 2017

Meet-ups

Melbourne Apple Admins for Thursday 28th September at REA
#franken-macadmins Meetup in Nuremberg, Germany, next meeting is on 9/28, for more info visit us over at #franken-macadmins
Netherlands Apple Admins will meet Thursday 9/28 at 1:30, at LAI in Schiedam, the Netherlands
Apple Admins of Seattle will meet on 9/28 at Synapse.
Mac Admin Monthly will meet on 10/10 at Google in New York and by Google Hangout.

Rate Us On iTunes!

Give Us Five Stars!

Sponsor Mac Admins Podcast!

If you’re interested in sponsoring the Mac Admins Podcast, please email podcast@macadmins.org for more information.

Social Media

Get the latest about the Mac Admins Podcast, follow us on Twitter! We’re @MacAdmPodcast!