CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are investigating a suspected intellectual property theft at a graphic design agency. A departing employee is suspected of staging proprietary project files before transferring them to external media.

The suspect's primary workstation is an Apple iMac running macOS Ventura. A forensic image (AFF4) has been captured. During the logical file system analysis of the user's home directory, you discover an anomalous file hidden within a dot-prefixed directory.

Evidence Collected (macOS Artifacts)

Question

During a forensic examination of a macOS computer, an analyst discovers a file with a .sparseimage extension. What does this file type typically represent?

Expert Analysis

1. What the evidence shows

The evidence reveals a file named project_alpha_archive.sparseimage located in a deliberately hidden directory (.hidden_vaults). Metadata shows the file currently consumes 4.2 GB of disk space but has a defined maximum capacity of 50 GB, indicating it was configured to hold a substantial amount of data.

2. Identify forensic stage

This scenario resides in the Examination & Analysis phase of the Digital Forensics Process, specifically dealing with macOS (APFS/HFS+) file system analysis.

3. Why correct answer is correct

A. An expandable disk image file: In macOS, a .sparseimage is a dynamic disk image format created by the Apple Disk Utility or hdiutil. Unlike a standard `.dmg` file which has a fixed size, a sparse image starts small and expands dynamically as data is added to it, up to its predefined maximum limit. Users often use them to create encrypted logical vaults to hide sensitive data.

4. Why others are wrong

• B. A system log file: macOS system logs typically end in .log, .asl (Apple System Log), or are stored in the unified logging system format (.traceV3) found in /private/var/db/diagnostics/.
• C. A temporary internet file: Temporary internet files (caches) are typically stored in SQLite databases or binary cache files located in ~/Library/Caches/.
• D. A backup of the macOS Registry (plist files): macOS does not have a "Registry" like Windows. Configuration settings are stored in Property List (.plist) files, usually found in /Library/Preferences/ or ~/Library/Preferences/.

5. Real-world forensic action

The investigator will export the .sparseimage from the forensic image and calculate its hash. In a secure forensic environment, the investigator will attempt to mount it using tools like BlackLight, MacQuisition, or natively via terminal (hdiutil attach -readonly). If the image prompts for a password, it indicates encryption (FileVault technology applied to the image). The investigator would then need to extract password hashes from the macOS Keychain or perform memory analysis (if a RAM capture was taken) to recover the passphrase to access the staged intellectual property.

6. MINI LESSON: macOS Disk Images