Chapter 17 — Key Takeaways

The big idea

macOS and Linux are half the modern caseload, not exotic detours — and they reward the examiner who learns their artifacts on their own terms. Technology changes; principles don't. macOS is a copy-on-write system (APFS) whose snapshots quietly preserve whole prior file-system states, layered with unusually rich activity databases; Linux wears much of its history in plain-text /var/log/ files, keeps binary login ledgers and a structured journal, and makes deleted-file recovery genuinely harder than NTFS. Binding both together is SQLite, where deleted is not destroyed applies to a database instead of a disk. No single artifact carries a cross-platform case — their agreement does, and the traces an anti-forensic step fails to erase usually convict it.

macOS: the file system is the evidence

APFS is copy-on-write: changed data goes to fresh blocks, old blocks linger, and a snapshot pins a transaction id (xid) so a deleted file often sits whole in an hourly snapshot. Containers (NXSB) hold volumes (APSB) that share free space.

Linux: text logs, binary logins, the journal

• /var/log/ (plain text, trivially edited): auth.log/secure, syslog/messages; rotates to .1, then .2.gz — check the .gz siblings.
• wtmp/btmp/utmp (binary; last/lastb/who): login success, failed logins, who's on now — harder to scrub cleanly, so a wtmp that disagrees with auth.log signals tampering.
• Shell history (.bash_history/.zsh_history): often no timestamps by default; written on exit — so history -c and unset HISTFILE get recorded in the history.
• systemd journal (LPKSHHRH): structured, microsecond-stamped, readable offline with journalctl --file.

ext4 is harder than NTFS — but the journal helps

• At deletion ext4 zeroes the inode's extent map ((none)), unlike NTFS, which retains data runs. The data blocks persist; the map to them is gone.
• The jbd2 journal (magic 0xC03B3998) often holds older inode copies with extents intact → ext4magic rebuilds the block map. Directory slack preserves the deleted filename + inode. Carving is the metadata-free fallback.
• Caveat: the journal is ~128 MB and circular — a fresh-deletion technique only.

SQLite: the cross-platform format

• Magic SQLite format 3\x00; deleted rows persist as freeblocks/freelist until reused or VACUUM'd.
• Always collect the -wal and -shm sidecars — the -wal holds the newest and superseded page versions. Work read-only on a copy.

You can now…

• ☐ Identify APFS containers/volumes/superblocks (NXSB/APSB) and enumerate and mount APFS snapshots read-only, explaining why copy-on-write makes them forensic gold.
• ☐ Extract and interpret Spotlight, FSEvents, the Unified Log (with uuidtext), knowledgeC (converting Mac absolute time with +978307200), Quarantine, and plists.
• ☐ Work the Linux artifact set — auth.log/secure, wtmp/btmp via last/lastb, shell history, cron/timers, and the systemd journal offline with journalctl --file.
• ☐ Explain why ext4 deletion is harder than NTFS and recover files via the jbd2 journal, directory-slack filenames, and carving — then hash the result.
• ☐ Recognize SQLite as the common format, collect its -wal/-shm, and recover deleted rows from freeblocks — and state the FileVault/LUKS, TRIM, retention, and time-zone limits.

Looking ahead

Chapter 18 — Browser and Internet Forensics. The SQLite skills you just built pay off immediately: history, cache, cookies, downloads, and sessions live in SQLite (places.sqlite, History, Web Data) on every one of these platforms — where intent and online activity are written down.

One sentence to carry forward: On a Mac the file system itself remembers the past, on Linux three logs watch every login, and on both a deleted database row is rarely as gone as someone hoped — so check the snapshot, collect the WAL, and say only what the artifacts prove.