MacOS Lockdown Mode: A Forensic Deep Dive
summary
Research shows macOS Lockdown Mode (introduced 2022 and now on four Apple OSes) changes behavior and leaves disk and log artefacts while blocking common acquisition paths. Detection methods include a one‑liner reading ldmGlobalEnabled in GlobalPreferences, unified log entries that show “lockdown mode state to on”, CIS diagnose output and a per‑user state.plist. Practical impacts: USB accessory restriction and disabled kernel extension loading can prevent physical imaging, Safari records per‑site overrides, and commercial forensic tools often miss these, making Lockdown Mode usable as an anti‑forensic hurdle.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 1:09Agenda and Lockdown Mode overview
- 3:15Purpose and history of Lockdown Mode
- 8:55Detecting Lockdown Mode on live systems
- 12:09Visual indicators of Lockdown Mode
- 16:04Forensic artifacts and logs
- 24:45Disk artifacts and configuration files
- 31:40Safari-specific restrictions and traces
- 32:22User account changes and memory analysis
- 33:48Caveats and anti-forensic implications
- 35:14Summary and acknowledgments
- 36:21Q&A session
related talks
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
44mBehind the scenes of iOS and Mac Security
32mA Case Study of MacOS Supply Chain Compromise
41mMacOS Behavioral Detections using Apple Endpoint Security API
45mmacOS application isolation and its exploitation
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
36mmacOS Vulnerabilities Hiding in Plain Sight