DFIR macBook Guide

A step by step Guide of setting up a DFIR macBook with my own preferences.

Note: If you got any issues with commands or errors using this guide, feel free to leave an issue in this repo :-)

Install macOS on your Mac

Two ways:

A - Reset or new Mac

Reset your macBook to Factory Default or maybe you got a new one already reset

B - Manual OS install

Create a Bootable USB with the prevered macOS (my is Golden Gate): https://support.apple.com/de-de/101578 Boot into the USB Stick (Intel: Option Key, M-Processor: Press and Hold the Power Button until you see the second screen):

• Use the Disk Utitlity to Erase the Macintosh HD (Top Level Volume) as APFS (as already selected).
• On Intel-Mac: Enable Firmware Password: https://support.apple.com/en-us/102384 (* X(Sign) + R -> Enter Recovery Mode)
• Click install your Mac Version on the Erased Drive. During Installation: Do not use wifi connection, bluetooth or icloud. Set a Strong Password

After first Boot - Basic Settings

System Settings WIFI:

• Connect to Hotspots off

Network:

• Enable Firewall -> Turn on Stealth Mode (Options)

Notifications:

• Disable: Notifications when display is slleeping and screen is locked

Sound:

• Alert Volume to lower
• Maybe disable sound at startup

General:

• Time: Add Timeserver: pool.ntp.org
• Airdrop: Disable Everything + Airdrop itself
• Sharing: Disable Everything
• Siri: Disable Siri and About Siri Privacy -> Disable Learn
• Spotlight:
  • Optional: Disable
  • Disable Improve Search to Apple Privacy and Security:
• Gatekeeper:
  • sudo spctl --master-disable
  • Select Trust All at the Bottom
• Analytics and Improvements: Disable Everything
• Enable FileVault

Desktop and Dock:

• Disable: Show suggested and recent apps in Dock
• Disable: Show Recent Apps in Stage Manager

Lock Screen:

• Turn display off: both 1 hour
• Require Password after Screensaver: Immediately

Wallpaper:

• Optional: Change to neutral wallpaper

Finder

• Hidden Files: command + shift + .
• Settings:
  • Enable All Items and New Finder Window: Documents/or Userfolder
  • Unsellect all Tags
  • Enable All Sidebar Icons (maybe except Recents)
  • Advanced: Show Filename Extensions

Application Firewall Little Snitch (enable later for better install experience)

Installing Basic Software

Using Homebrew

Important: Install Homebrew first and follow the Terminal Guidelines printed while using: [https://brew.sh]([https://brew.sh]( and Restart your Terminal app:) and Restart your Terminal app:

Upgrade and Cleanup:

brew update
brew upgrade --greedy
brew cleanup -s

Disable Analytics

brew analytics off

Main Software

brew install --cask google-chrome 
brew install --cask proton-pass
brew install --cask obsidian

Terminal Guide

I recommend using the vanilla mac terminal with the powerlevel10k theme:

sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"
chsh -s $(which zsh)

brew install powerlevel10k
echo "source $(brew --prefix)/share/powerlevel10k/powerlevel10k.zsh-theme" >>~/.zshrc
brew install fzf
brew install tmux
git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting
git clone https://github.com/zsh-users/zsh-autosuggestions $ZSH_CUSTOM/plugins/zsh-autosuggestions
source ~/.zshrc

Replace this plugins within you ~/.zshrc plugins=(git colored-man-pages colorize pip python brew zsh-autosuggestions zsh-syntax-highlighting)

Daily Software

brew install --cask visual-studio-code
brew install --cask handbrake-app
brew install --cask balenaetcher
brew install --cask cyberduck
brew install --cask jdownloader
brew install --cask keka
brew install --cask cmake-app
brew install --cask vlc
brew install smartmontools
brew install python3
brew install ffmpeg
brew install ffmpeg-full
brew install --cask docker-desktop
brew install --cask libreoffice-still
brew install gsmartcontrol
brew install --cask obs

DFIR Tools

Brew Tools

brew install --cask db-browser-for-sqlite
brew install ghidra
brew install httrack 
brew install --cask cutter
brew install hashcat



# Opt
# Fences ALternative
brew tap jarusll/tap
brew install --cask jarusll/tap/tokri

Apple (macOS and iOS) Specific DFIR Tools:

Install XCode via App Store

Brew Tools:

brew install john-jumbo
brew install sleuthkit
brew install initz3r0/tap/ibex

Python:

pip3 install biplist lz4 pyliblzfse --break-system-packages

Others:

• Epochalypse.py: https://github.com/pstirparo/utils/blob/master/epochalypse.py

Manual:

• https://sqlitebrowser.org/dl/

• http://hexfiend.com
• https://www.sparklabs.com/viscosity/ (Optional)
• https://www.icopybot.com/download.htm
• https://github.com/aburgh/Disk-Arbitrator
• https://github.com/Lazza/Fuji
• https://github.com/prosch88/UFADE
• https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts
• https://github.com/EC-DIGIT-CSIRC/sysdiagnose
• https://github.com/initz3r0/ibex
• https://github.com/nowsecure/fsmon
• https://github.com/insidegui/VirtualBuddy
• https://github.com/mandiant/macos-UnifiedLogs
• https://github.com/ydkhatri/MacForensics/blob/master/Deserializer/deserializer.py
• https://github.com/nicoleibrahim/DSStoreParser
• https://github.com/dscho/dsstore
• https://exiftool.org/
• https://github.com/ydkhatri/mac_apt
• https://github.com/ydkhatri/spotlight_parser

Other Manual Install Tools:

• https://www.sweetscape.com/download/010editor/
• https://portswigger.net/burp/downloads
• https://www.autopsy.com/download/
  • https://github.com/sleuthkit/autopsy/blob/develop/Running_Linux_OSX.md
• https://www.maltego.com/downloads/
• https://github.com/horsicq/DIE-engine/releases
• https://github.com/mandiant/flare-floss/releases
• https://www.wireshark.org/download.html
• https://lmstudio.ai/download?os=darwin&arch=arm64
• https://www.cgsecurity.org/wiki/TestDisk_herunterladen
• https://angryip.org/download/#mac
• https://exiftool.org/
• https://mac.getutm.app/
• https://www.telerik.com/download/fiddler
• https://github.com/WithSecureLabs/chainsaw/releases/tag/v2.13.1
• https://github.com/Yamato-Security/hayabusa/releases
• https://github.com/Neo23x0/Loki
• https://www.nextron-systems.com/thor-lite/
• https://tzworks.com/download_links.php
• https://github.com/wagga40/Zircolite
• https://www.elcomsoft.com/free_forensic_tools.html
• https://www.quickhash-gui.org/downloads/
• https://github.com/volatilityfoundation/volatility3
• https://www.clamav.net/downloads
• https://binary.ninja/free/
• https://github.com/decalage2/balbuzard#download-and-install
• https://github.com/java-deobfuscator/deobfuscator/releases/tag/latest
• https://github.com/eteran/edb-debugger/
• https://github.com/java-decompiler/jd-gui/releases/tag/v1.6.6
• https://github.com/cybersecurity-team/Scylla
• https://github.com/SigmaHQ/sigma
• https://www.snort.org/
• https://github.com/VirusTotal/yara
• https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
• https://blog.didierstevens.com/didier-stevens-suite/
• https://github.com/decalage2/oletools
• https://github.com/gchq/CyberChef
• https://github.com/csababarta/memory-baseliner/
• https://github.com/mnrkbys/vss_carver
• https://plaso.readthedocs.io/en/latest/sources/user/MacOS-Source-Release.html
• https://github.com/tfrdidi/sort-PhotorecRecoveredFiles/
• https://github.com/bring2lite/bring2lite/
• https://github.com/pawlaszczyk/fqlite
• https://github.com/hiddenillusion/AnalyzePDF

Some Recommendations

Security

• Set a Strong Password
• Enable FileVault (System Preferences -> Security & Privacy -> FileVault) -> Whole Disk Encryption of HPS+ or APFS Volumes
• On Intel Mac: Firmware Password (In Recovery Mode Enabled)
• System Integrity Protection (SIP) -> On by Default

Must Know Apple Key Combinations INTEL:

• alt/option key -> Boot Options
• X(Sign) + R -> Enter Recovery Mode
• T - Target Disk Mode M:
• Press and Hold the Power Button until you see the second screen

Internal Tools System Profiler GUI (About -> System Report) / (Settings -> General -> System Report) -> system_profiler Man Page - macOS - SS64.com !

Disk Utility

My way of setting up my macbook with some security reasons in mind.

Other Tools Offensive VM (optional): https://www.kali.org/docs/virtualization/install-vmware-silicon-host/