Forensics

Forensic Methodology

How macfor implements forensically sound collection aligned with ISO 27037 principles.

Overview

macfor is designed from the ground up to support forensically sound investigations. Every design decision prioritises evidence integrity, reproducibility, and documentation—the pillars of admissible digital evidence.

Guiding Principles

1. Never Modify Source Evidence

macfor operates in read-only mode whenever possible. We never:

  • Modify timestamps on source files
  • Alter file contents during collection
  • Write to the source file system
  • Change system state during collection

For artifacts that require special handling (like SQLite databases with active WAL files), we create temporary copies and document this in the chain of custody.

2. Document Everything

Every macfor collection includes comprehensive documentation:

  • Manifest: What was collected, when, and by which tool version
  • Chain of Custody: Timestamped log of every action taken
  • Hash Manifest: SHA-256 hash of every collected file
  • Collection Log: Detailed progress and any errors encountered

3. Verify Integrity

All collected files are hashed using SHA-256 during acquisition. These hashes are stored in hashes.json within the evidence container, enabling:

  • Verification that files haven't been modified since collection
  • Detection of transmission errors
  • Court-admissible proof of evidence integrity

4. Preserve Original Data

macfor preserves artifacts in two forms:

  1. Raw Files: Original files copied byte-for-byte
  2. Parsed Records: Structured JSONL data extracted from artifacts

This dual approach ensures that:

  • Original evidence is always available for independent verification
  • Parsed data can be easily analysed and searched
  • Future parsing improvements can be applied to preserved originals

ISO 27037 Alignment

macfor's methodology aligns with ISO/IEC 27037:2012 (Guidelines for identification, collection, acquisition and preservation of digital evidence).

Relevance

We collect artifacts based on defined forensic value, documented in our artifact catalogue. Each artifact type specifies:

  • What data is collected
  • Why it's forensically valuable
  • Potential limitations or caveats

Reliability

macfor produces consistent, reproducible results:

  • Same input produces identical output
  • Deterministic parsing with documented behaviour
  • Version-controlled tool with release notes

Sufficiency

Evidence containers include everything needed for independent analysis:

  • Original files for re-parsing
  • Tool version information
  • System context (hostname, OS version)
  • Collection parameters

Auditability

Complete audit trail in every evidence container:

  • Chain of custody with timestamps
  • Action logging for every operation
  • Error documentation for failed collections

Evidence Container Format

macfor produces ZIP-based evidence containers with a standardised structure:

evidence-container.zip
├── manifest.json           # Collection metadata
├── chain-of-custody.json   # Audit trail
├── hashes.json             # SHA-256 verification hashes
├── artifacts/              # Raw collected files
│   └── {category}/{plugin}/files/
├── records/                # Parsed structured data
│   └── {plugin}/parsed.jsonl
└── logs/                   # Collection logs
    └── {plugin}/collection.log

Manifest Structure

{
  "collection_id": "550e8400-e29b-41d4-a716-446655440000",
  "tool_version": "1.0.0",
  "collection_time": "2026-01-28T10:30:00Z",
  "duration_ms": 23758,
  "source": {
    "type": "live",
    "hostname": "macbook-pro.local",
    "os_version": "14.2.1"
  },
  "plugins": [...]
}

Chain of Custody Structure

{
  "entries": [
    {
      "timestamp": "2026-01-28T10:30:01Z",
      "action": "collection_started",
      "actor": "macfor 1.0.0",
      "details": {}
    },
    {
      "timestamp": "2026-01-28T10:30:02Z",
      "action": "file_added",
      "actor": "shell.history",
      "target": "artifacts/shell/files/admin/zsh_history",
      "details": {
        "source_path": "/Users/admin/.zsh_history",
        "sha256": "abc123..."
      }
    }
  ]
}

Best Practices

Before Collection

  1. Document the scene: Note system state, running applications, connected devices
  2. Photograph if relevant: Screen contents, physical setup
  3. Consider volatile data: Memory, network connections (future macfor feature)
  4. Plan your collection: Decide which artifacts are needed

During Collection

  1. Use dry run first: Preview what will be collected with --dry-run
  2. Run with elevated privileges: Use sudo for multi-user collection
  3. Monitor for errors: Check output for permission or access issues
  4. Don't interrupt: Let collection complete to ensure container integrity

After Collection

  1. Verify the container: Check that the ZIP is valid and complete
  2. Document transfer: Log how evidence was moved or copied
  3. Secure storage: Store evidence containers in access-controlled locations
  4. Maintain chain of custody: Document who accessed the evidence and when

Limitations

macfor is designed for artifact collection, not full disk imaging. Consider these limitations:

  • No memory acquisition: Volatile data is not collected
  • No deleted file recovery: We collect existing files, not carved data
  • No encryption bypass: FileVault volumes must be unlocked
  • No network state: Current connections are not captured

For comprehensive forensic acquisition, combine macfor with disk imaging tools and memory forensics solutions.

Training and Certification

We recommend forensic practitioners using macfor have:

  • Understanding of macOS file system structure
  • Familiarity with common macOS artifacts
  • Knowledge of chain of custody requirements
  • Experience with digital evidence handling

Further Reading