This scenario simulates a live digital forensics examination focusing on macOS hardware artifacts. You will learn to identify the correct utility and data type used to trace external peripheral connections during a suspected data exfiltration incident.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

A graphic designer at a marketing agency is suspected of stealing unreleased, highly confidential design assets before resigning. The agency's DLP (Data Loss Prevention) software was disabled locally on the suspect's MacBook Pro.

During a desk search, a physical SanDisk USB drive was recovered. As the forensic examiner, your objective is to analyze the forensic image of the MacBook Pro to prove that this specific USB drive was historically connected to the suspect's machine, thereby establishing the mechanism of exfiltration.

Evidence Collected

Question

An investigator needs to find traces of external peripheral devices (like USB drives) that were previously connected to a macOS computer. Which of the following contains this information?
Investigator Hint: Think about the built-in macOS profiling utility (accessible via GUI or CLI) that specifically profiles hardware data types, including USB, Bluetooth, and PCIe devices.

Expert Analysis

1. What the evidence shows:
We have a physical SanDisk USB drive (EVID-002) with a known Vendor ID (VID: 0x0781). To link it to the suspect, the examiner must find a matching VID, Product ID (PID), and Serial Number within the historical hardware artifacts of the macOS forensic image (EVID-001).

2. Forensic Stage:
Examination and Analysis. The physical media and disk images have been preserved. The investigator is now querying specific system artifacts to reconstruct user activity and device history.

3. Why correct answer is correct (A):
In macOS, the `System Information` utility (accessible via GUI or the `system_profiler` command-line tool) gathers comprehensive hardware data. The specific data type `SPUSBDataType` lists all currently and historically connected USB devices, providing critical forensic metadata such as Vendor ID, Product ID, Serial Number, and manufacturer strings.

4. Why others are wrong:
- B (com.apple.Boot.plist): This file contains kernel boot arguments and startup configurations, not peripheral device connection history.
- C (/var/log/daily.out): This is a standard output log for automated daily maintenance scripts (like cleaning up old files or rotating logs), not a repository for USB artifact tracking.
- D (/etc/hosts): This file is used for local DNS resolution, mapping IP addresses to hostnames. It contains no hardware or peripheral data.

5. Real-world forensic action:
The investigator will mount the DMG image and extract historical profiling data, or execute `system_profiler SPUSBDataType` against the live/mounted volume. They will parse the output looking for the SanDisk VID `0x0781` and match the unique serial number to the physical drive seized at the suspect's desk.

MINI LESSON: Artifact Interpretation
Unlike Windows, which relies heavily on the Registry (e.g., `SYSTEM\CurrentControlSet\Enum\USBSTOR`) for USB history, macOS relies on unified logs, `.plist` files, and the `system_profiler` command. Establishing the connection of a specific storage device is a critical step in the Chain of Custody for data exfiltration cases, moving the investigation from "data was copied" to "data was copied to this specific drive."

Ready for the next investigation?

Master your forensic process and evidence analysis skills.

Explore more CHFI simulations