Ask HN: How to inspect a Macbook? | Hacker News Reader

Ask HN: How to inspect a Macbook?

1 pointjoshmlewis11 comments

So a lady came to me wanting to know if I could look at her Macbook. Apparently her husband was an IT guy and they divorced, well that wasn't pretty. He supposedly put key loggers and spyware programs on her Macbook and now she's pulling her hair out because no one will look at Macs around here.

My question: There is so much junk on here, I just want to wipe it all and start over but she wants me to actually investigate and see if there are shady programs on here and document it. How would I go about doing such things? Also, does anyone know of a program that shows all outgoing internet connections and if there are fishy files?

View on HN

Josh - You can have the best of both worlds. Boot to a spare HD or Target boot, use Disk Utility and take a DMG of the hard drive as it sits now. You can move that to where ever you want to examine the contents.

This frees up the drive for reloading the OS (and this is a must if you suspect foul play) and you can examine at your leisure knowing you have an exact image of the drive.

If you are in the Bay Area, CA, I would be happy to help over coffee. Contact info in profile.

Also, does anyone know of a program that shows all outgoing internet connections and if there are fishy files?

Wireshark, though it's got a bit of a curve to it, provided you know how to identify packets.

Wouldn't malware be smart enough by now not to send stuff while Wireshark's running, or even to not send while the machine's actively being used?

Typically yes, but if it's communicating, it's got to do it somehow, which is why I added the caveat that op knows how to read a packet output.

LilSnitch will show all outgoing request

I've heard great things from paranoids about Little Snitch on OS X.

I'm downloading it now. I deleted all the apps except the basic Mac apps. I'm going through the activity monitor trying to find things that don't look right.

There was a VPN client which I'm assuming he's used.

Well, at this point, it's all idle curiosity on her and your part. The first thing you should have done is image off a couple of copies of that drive. One for archive, the other to examine.

A ram snapshot would have been good as well.

Ah yeah. Good idea. I don't think it's really that big of a deal, I think she was just curious. I would be too. Everything looks ok for now though. I don't think he would be that smart working for a company around here.

I found a thing called rpc.lockd. Looks like its some type of linux command. Anyone know anything?

And syslogd.

rpc.lockd - http://developer.apple.com/library/mac/#documentation/Darwin...

syslogd - http://developer.apple.com/library/mac/#documentation/Darwin...

Reply on news.ycombinator.com