IT Forensics · macOS

Carrying out Mac triage using SUMURI RECON ITR

Triage addresses a different question to that posed by an acquisition. Not „How do I back up this Mac in its entirety?“, but: Which of several Macs, which user account and which time period is relevant to the case – and what needs to be backed up and analysed first? Triage is therefore a decision-making tool for cases where there are multiple devices, time is of the essence, or the scope of the investigation is to be deliberately limited.

Enquire without obligation

Technical background

SUMURI RECON ITR is designed for imaging and triage; this page deals exclusively with triage – backup methods and device generations are covered on the acquisition page. A triage reviews selected groups of artefacts and processes them quickly. It is deliberately incomplete: anything not included in the triage is not necessarily excluded. For this reason, the selection criteria, scope and timing are documented – so that it remains clear later on why a device was prioritised or deferred.

Relevant evidence and data sources

  • Which user accounts were active during the period in question?
  • Were any external storage devices connected or were any cloud services used?
  • Are there any matches for specified files, programmes or communication partners (keyword and hash lists)?
  • Which of several devices is likely to contain the relevant evidence?

Why LanCologne?

LanCologne does not examine Apple computers according to a standardised, one-size-fits-all approach, but rather on the basis of their specific hardware and security architecture. Our staff have decades of experience in information technology and many years of practical experience in IT forensics.

Here’s how we do it

  • Agree the scope, timeframe and search criteria with the client in advance.
  • Triage of selected artefact groups; the selection and any changes to the device’s status are logged.
  • Decision for each device: full backup, selective logical backup or reset – giving reasons in each case.
  • Relevant triage results are validated against the original artefacts during the subsequent evaluation.

Borders

  • Triage is not an analysis: the absence of a match does not prove that no traces are present.
  • A triage carried out whilst the system is running alters its state; the changes are documented, but cannot be avoided.
  • The data that can actually be accessed on current Macs depends on the condition of the device (see the data acquisition page).

Possible results

  • Triage protocol setting out selection criteria, scope and timing
  • Prioritised list of equipment and assessments, with reasons given
  • Recommendation regarding the scope of further security measures

Frequently Asked Questions

When is a triage sufficient, and when is a full acquisition required?
Triage, when a quick decision needs to be made as to which devices and data are relevant, or when the scope needs to be limited. A full acquisition, when a device has been identified as relevant to the evidence or when deleted data and timelines need to be examined in detail.
Does triage replace the subsequent assessment?
No. It sets priorities. Reliable findings can only be obtained through validation against the original artefacts.
Can triage limit the scope of the examination, for example for data protection reasons?
Yes, provided that the time period and search criteria are defined and documented in advance. The client should consult their legal advisers to determine whether this restriction is legally sufficient.

Related topics

LanCologne – macOS Forensics in Cologne

Do you require a professional investigation into „Carrying out Mac triage with SUMURI RECON ITR“? LanCologne supports you in securing evidence in a legally admissible manner, carrying out multi-stage analysis and producing traceable documentation. The key here is not to generate as many automated hits as possible, but to secure technically sound and verifiable evidence.

Get in touch now