A QuickLook at macOS thumbnails

This talk introduces the centralised thumbnail caching mechanism of the newest version of macOS, as well as describes real-life examples of usage of thumbnail cache forensics for digital forensic investigations.

Transcript

1. A QuickLook at macOS thumbnails Le Tour du Hack 2019 Kinga Kieczkowska @kieczkowska
2. Who am I? @kieczkowska #LTDH19
3. What are thumbnails? code, text editor files, PDFs, images, videos, etc @kieczkowska #LTDH19
4. What do we know about thumbnail caches? Windows & Linux macOS @kieczkowska #LTDH19
5. What are thumbnail caches? ~/var/folders/<random 2 letter string> /<random long string> /C/com.apple.QuickLook.thumbnailcache @kieczkowska #LTDH19
6. Tables of interest: Index. sqlite @kieczkowska #LTDH19
7. Files table @kieczkowska #LTDH19 Thumbnails table path, often includes volume name includes volume ID and file ID (CNID) file name (duh) How many times was the file viewed? Last time the file was accessed
8. How does a thumbnail end up in the cache? @kieczkowska #LTDH19
9. Example #1: moving a file @kieczkowska #LTDH19
10. Example #1: moving a file @kieczkowska #LTDH19
11. Example #2: moving a file from an external device @kieczkowska #LTDH19
12. Example #2: moving a file from an external device @kieczkowska #LTDH19
13. Example #3: renaming a file @kieczkowska #LTDH19
14. Example #4: deleting a file @kieczkowska #LTDH19
15. Example #4: deleting a file @kieczkowska #LTDH19
16. Why do we care? HACKED @kieczkowska #LTDH19
17. QuickLook vulnerability in High Sierra @kieczkowska #LTDH19
18. And then… Mojave happened @kieczkowska #LTDH19
19. Well, how is that useful then? @kieczkowska #LTDH19
20. Why is this important? @kieczkowska #LTDH19
21. Thank you Questions à@kieczkowska, or in the pub All links, resources, slides at kieczkowska.works @kieczkowska #LTDH19