<div dir="auto">Thank you, sir. </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 17, 2019, 7:24 PM Russell Standish <<a href="mailto:lists@hpcoders.com.au">lists@hpcoders.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Using Linux, you can just mount the Mac's hard drive, and use unix<br>
tools to investigate those files that were touched in the time span of<br>
interest. To be really sure, you should clone the drive first (eg<br>
using the Linux dd command) so that you don't accidently destroy any<br>
evidence in your poking around (you work with just the copy).<br>
<br>
As for the iPhone, I don't know how you would clone its storage, as<br>
it's locked down by Apple. Presumably, you would need to jail break<br>
the device first (potentially destroying the evidence you're looking<br>
for). But once you have cloned it, you can mount the storage on Linux<br>
as per usual - I believe iOS just uses the normal HDF+ file system<br>
that MacOSX uses.<br>
<br>
Cheers<br>
<br>
On Wed, Apr 17, 2019 at 10:42:52AM -0600, Tom Johnson wrote:<br>
> A friend writes:<br>
> <br>
> "A friend and colleague recently died under suspicious/unclear circumstances<br>
> overseas and the local police appear to have somehow unlocked his Apple devices<br>
> (an iphone and Macbook laptop).<br>
> <br>
> Those devices are now in the family's possession and I said I'd look into<br>
> whether tools or experts might exist to help assess what files/stuff were<br>
> accessed, deleted, or added to his devices close to and since the evening of<br>
> his death.<br>
> Can you offer any advice?"<br>
> <br>
> FRIAM-ers: any suggestions or advice?<br>
> <br>
> Tom<br>
> <br>
> ============================================<br>
> Tom Johnson - <a href="mailto:tom@jtjohnson.com" target="_blank" rel="noreferrer">tom@jtjohnson.com</a><br>
> Institute for Analytic Journalism -- Santa Fe, NM USA<br>
> 505.577.6482(c) 505.473.9646(h)<br>
> NM Foundation for Open Government<br>
> Check out It's The People's Data <br>
> ============================================<br>
> <br>
> <br>
> [icon-] Virus-free. <a href="http://www.avast.com" rel="noreferrer noreferrer" target="_blank">www.avast.com</a><br>
> <br>
> <br>
<br>
> ============================================================<br>
> FRIAM Applied Complexity Group listserv<br>
> Meets Fridays 9a-11:30 at cafe at St. John's College<br>
> to unsubscribe <a href="http://redfish.com/mailman/listinfo/friam_redfish.com" rel="noreferrer noreferrer" target="_blank">http://redfish.com/mailman/listinfo/friam_redfish.com</a><br>
> archives back to 2003: <a href="http://friam.471366.n2.nabble.com/" rel="noreferrer noreferrer" target="_blank">http://friam.471366.n2.nabble.com/</a><br>
> FRIAM-COMIC <a href="http://friam-comic.blogspot.com/" rel="noreferrer noreferrer" target="_blank">http://friam-comic.blogspot.com/</a> by Dr. Strangelove<br>
<br>
<br>
-- <br>
<br>
----------------------------------------------------------------------------<br>
Dr Russell Standish Phone 0425 253119 (mobile)<br>
Principal, High Performance Coders<br>
Visiting Senior Research Fellow <a href="mailto:hpcoder@hpcoders.com.au" target="_blank" rel="noreferrer">hpcoder@hpcoders.com.au</a><br>
Economics, Kingston University <a href="http://www.hpcoders.com.au" rel="noreferrer noreferrer" target="_blank">http://www.hpcoders.com.au</a><br>
----------------------------------------------------------------------------<br>
<br>
============================================================<br>
FRIAM Applied Complexity Group listserv<br>
Meets Fridays 9a-11:30 at cafe at St. John's College<br>
to unsubscribe <a href="http://redfish.com/mailman/listinfo/friam_redfish.com" rel="noreferrer noreferrer" target="_blank">http://redfish.com/mailman/listinfo/friam_redfish.com</a><br>
archives back to 2003: <a href="http://friam.471366.n2.nabble.com/" rel="noreferrer noreferrer" target="_blank">http://friam.471366.n2.nabble.com/</a><br>
FRIAM-COMIC <a href="http://friam-comic.blogspot.com/" rel="noreferrer noreferrer" target="_blank">http://friam-comic.blogspot.com/</a> by Dr. Strangelove<br>
</blockquote></div>