Forensic Analysis of current TBB on Mac OS X 10.x

added SponsorJ SponsorL component::applications/tor bundles/installation owner::runa priority::medium resolution::fixed status::closed type::project labels

Trac:
Type: defect to project

Trac:
Cc: N/A to g.koppen@jondos.de

Trac:
Cc: g.koppen@jondos.de to g.koppen@jondos.de, runa

Status?

I have everything set up and ready to go, so some progress has been made. I expect to have some partial results within the next couple of weeks.

Trac:
Keywords: N/A deleted, SponsorL added

The use case I am going to cover is:

• User boots OS X 10.8
• User logs in as a normal user (i.e. not admin)
• User attaches an external drive
• User copies the Tor Browser Bundle archive from the external drive to the Desktop
• User extracts the Tor Browser Bundle
• User runs the Tor Browser Bundle by clicking on the Tor Browser icon
• User browses a few sites in the Tor Browser
• User closes the Tor Browser window and clicks the Exit-button in Vidalia
• User deletes the Tor Browser package and archive, and empties the trash
• User shuts down OS X 10.8

Trac:
Owner: erinn to runa
Status: new to assigned

Trac:
Cc: g.koppen@jondos.de, runa to g.koppen@jondos.de, runa, StrangeCharm

Trac:
osx_changed_files.txt

Related tickets:

• Apple System Log (ASL) files contain traces of the Tor Browser Bundle
• OS X Crash Reporter and Diagnostic Messages contain traces of the Tor Browser Bundle
• OSX FSEvents API files contain traces of the Tor Browser Bundle
• OS X HFS+ files may contain traces of the Tor Browser Bundle
• OS X preference files contain traces of the Tor Browser Bundle
• OS X Saved Application State contains some TBB website window titles
• Spotlight and mds may have indexed the Tor Browser Bundle
• OS X swap file may contain traces of the Tor Browser Bundle
• OS X per-user temp files contain traces of the Tor Browser Bundle

Final report is available on https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28.pdf

Trac:
Status: assigned to closed
Resolution: N/A to fixed

closed

mentioned in issue #7032 (moved)