Moving Forward

I had initially decided to analyze plist changes between versions of Safari, Dropbox, Skype and Spotify, but after consulting with my professor Jonathan Rajewski we decided that Spotify was not forensically relevant. Google's Chrome browser will be taking it's place, which will provide the added benefit of a contrast with Safari.

Here is an updated table of versions I will be conducting plist analysis of:

I acquired a Mac yesterday thankfully, I was having trouble finding a spare and I couldn't afford a new one. I would like to thank Daniel Doonan for letting me borrow his machine. The system specs are as follows:

Mac OS X v. 10.8.2
2.26 GHz Intel Core 2 Duo
4GB 1067 MHz DDR3

Testing Methodology:

I will be installing the earlier versions of all four applications first, then generating realistic user activity to provide sample data for the plists. The user activity will be thoroughly documented and identical between versions. I also plan on making the fake user activity between Safari and Chrome horizontally identical to provide a clear contrast of the differences in plist information tracking between two of the most commonly used browsers. I will then use FTK Imager to acquire the data.

To ensure that any system-wide artifacts don't remain between user accounts or installs which may interfere with my results, I will be formatting the disk between installs of the applications and their respective versions. After I am finished I will be left with two forensic images (and their MD5 hashes) which I can then export the application plists (XML format) from.

I discovered a really awesome tool developed recently by Mari DeGrazia, which is listed on her blog "http://az4n6.blogspot.com/" It's called iParser (clever name haha) and it parses plist files and outputs them to a folder. It comes with a simple GUI shown below:




















It also gives you the ability to add in plists as a plugin if you find yourself constantly parsing the same files. I will run my exported plists through this tool, and provided the hashes match I will then swan dive into my research and see what data each application/version is tracking, how it has changed between versions, what may be prompting the update of such plist data and anything else of forensic interest I can find.