MacOS forensic I

What it is

A hands-on macOS memory-forensics walkthrough using Volatility 2 against a raw memory dump (file.dmp) from a Mac running OS X 10.8 "Mountain Lion" (build 12A269). It documents the specific commands and two tricks the author couldn't find elsewhere.

What to do

When you have only a dump and no prior system access, recover the OS version by grepping for the version string, then confirm the build number against Apple's dev kits:

grep -Eao "Version [0-9]+.[0-9]+ \([a-zA-Z0-9 ]+\)" file.dmp

Fetch a matching profile from the community repo (or build one), drop it in profiles/, and drive all plugins with --plugins=./profiles --profile=MacMountainLion_10_8_1_AMDx64. Verify the profile loads with mac_version before proceeding, and list available plugins with -h | grep "mac_".

Core enumeration order the page recommends: mac_pslist → mac_psaux (full command lines) for processes; mac_list_files (piped through tee to save the list) and mac_lsof for files; mac_dump_file to pull files out of memory; mac_bash for shell history.

Two useful tricks:

Enumerate all file extensions present in the cached-file list to spot interesting types:

grep -oE "\.[a-z]{3,4}$" list_files | sort | uniq

Bulk-extract every file whose path matches a string. Save the matching lines, then feed them to a script that dumps each by offset (always prefix output filenames with the offset to avoid collisions):

#!/bin/bash
FILES=$1
OUTDIR=extracted_files/$2
while read f; do
    offset=$(echo "$f" | awk '{ print $1 }')
    name=$(echo "$f" | awk '{ print $2 }')
    name=$(basename $name)
    vol.py --plugins=./profiles --profile=MacMountainLion_10_8_1_AMDx64 -f file.dmp mac_dump_file -O ${OUTDIR}/${offset}_${name} --file-offset ${offset}
done < $FILES

grep -i "some_string" list_files > files_some_string
./extract_files.sh files_some_string out_some_string

Caveats

The author calls the extraction script "ugly" and "probably not the best nor the cleanest solution" — it's a time-saver, not a robust tool. Only files cached in memory can be dumped this way (mac_list_files/mac_dump_file operate on the memory image, not the disk). The whole workflow depends on a profile existing or being buildable for your exact OS build; the author only worked with 10.8 and notes recent macOS versions were untested.