Detection Of Backdating The System Clock In MacOS
Wednesday, January 31, 2018 (11:42:44)
Posted by scar
by Oleg Skulkin & Igor Mikhaylov
Recently we received a good question from one of our DFIR mates: “How can one detect backdating of the system clock forensicating macOS?”. This is a really good question, at least for us, so we decided to research it. If we are talking about Windows system clock backdating there are a lot of information to help, for example, this SANS white paper by Xiaoxi Fan, but there is nothing about macOS.
Let’s start from macOS timestamps as they are very interesting and have a lot of evidentiary value. Let’s start from running mdls command on a sample file.
Content received from: Forensic Focus, http://www.forensicfocus.com