Welcome to this CHFI practice scenario. Here, you will refine your macOS forensic skills by identifying the correct artifact locations for system and application configurations. Master this to accelerate your evidence collection phase.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

A New York City investment firm suspects a recently terminated employee of exfiltrating proprietary trading algorithms. A forensic image of the suspect's assigned MacBook Pro (macOS Sonoma) has been acquired. The investigation requires identifying unauthorized third-party synchronization tools or altered system configurations that facilitated the data theft.

Evidence Collected

Question

In a corporate-espionage case in New York City, a forensic examiner is analyzing a suspect's Mac computer. The examiner needs to locate system-level configuration files and application settings that may provide clues about the suspect's activities. Which of the following directories on the macOS file system should the examiner prioritize?
Hint: Look for the directory that stores Preferences, Application Support, and LaunchDaemons for all users, rather than the core OS files or individual user profiles.

Expert Analysis

  1. What evidence shows

    The investigation requires the extraction of system-level configuration files and application settings used by potentially malicious or unauthorized third-party tools.

  2. Identify forensic stage

    Collection & Examination (Targeted logical acquisition and artifact parsing).

  3. Why correct answer is correct (B)

    The /Library/ directory contains system-wide settings, global Preferences (.plist files), Application Support data, and LaunchDaemons that apply to all users on the Mac. It is the primary location for non-OS system-level configurations.

  4. Why others are wrong

    A (/Users/): Contains user-specific data (~/Library/Preferences), not system-level configurations.
    C (/System/): Contains core macOS files. Modern macOS protects this with System Integrity Protection (SIP), making it read-only and an unlikely location for third-party application configurations.
    D (/Applications/): Contains the application bundles (.app) themselves. While bundles contain default plists, dynamic runtime settings and configurations are stored in the Library directories.

  5. Real-world forensic action

    Investigators mount the APFS volume and navigate to /Library/Preferences/ and /Library/LaunchDaemons/ to parse property list files using tools like plutil, or ingest the image into forensic suites (e.g., Magnet AXIOM, Cellebrite Inspector) to automatically parse persistence mechanisms and global application settings.

  6. MINI LESSON: macOS Library Hierarchy

    • /System/Library: Core Apple OS components only. Protected by SIP.
    • /Library: System-wide configurations accessible to all users. Prime target for global persistence and third-party application settings.
    • ~/Library: Specific user configurations and local application support data. Prime target for user-specific activity and preferences.

Ready for the next investigation?

Explore more CHFI simulations and refine your forensic examination skills.

Explore more CHFI simulations