This section demonstrates how to run MacForensicsLab for the first time.
To launch the MacForensicsLab application, double click on the MacForensicsLab.app icon.
Configure MacForensicsLab Preferences
Once the MacForensicsLab application is launched, the Preferences Pane will open. In order to successfully run MacForensicsLab, the Preferences Pane must be filled out.
Configure a Local Database File
In this example we will configure a Local File database (this means the database file will be resident on the local machine and not connected remotely to a database). The "Database" tab in the upper left of the window is selected (1), then select the "Local File" (2), next select "Create" (3).
Save the Local Database
Once the "Create" button is selected in the previous step, a navigation window appears. The navigation window allows the user to select the location of the database file. By default the file is named "MacForensicsLab Database.rsd" (1) and is located in Documents folder (2), then select "Save."
Configure the Examiners Tab
The next tab to configure in the Preferences Pane is the "Examiners" tab. Select the "Examiners" tab (1). To add an examiner, select the "+" radio button on the left (2). Once the radio button is selected an Examiner window will open.
Configure Examiner Window
Fill out the fields to complete the Examiner window, then select "Save."
Confirm Examiner Information
The Preference Pane appears and the new examiner information can be noted.
Configure the Cases Tab
To add a new case to the database, select the "Cases" tab (1) along the top of the window. Add a case by selecting the "+" radio button in the lower left (2). Once the radio button is selected a case Details pop-up window will appear.
In the Case Details window enter the case number or Case ID and a description of the case. Once completed, select "Save".
Selecting the Case
Once the "Save" button is selected in the previous step, the user is returned to the Preferences Pane. Be sure to highlight the new case, as seen above.
The E-Mail Pane
The purpose of the E-Mail pane is to enable the user to be notified upon completion of tasks being conducted by MacForensicsLab.
Complete the E-Mail Pane
Complete all requisite information and select "Test:" (1) to ensure the connection is properly configured, once the test is successful, select the "Continue" button (2).
Authenticate MacForensicsLab
MacForensicsLab requires the user to authenticate by entering the admin password.
Complete Authentication
Enter the admin password (1) and then select "OK" (2).
Disk Arbitration
To complete the configuration of MacForensicsLab in preparation of running it for the first time, the user needs to decide whether to ignore disk arbitration (leaving it enabled) or to disable it. The user should only disable disk arbitration if he/she intends to create a forensic image from the suspect's media. Once either the "Ignore" or the "Disable" buttons are selected, the main window of MacForensicsLab opens.
