Prefetch Forensic

Prefetch files as defined in ForensicWiki is “Windows Prefetch files, introduced in Windows XP, are designed to speed up the application startup process.” Prefetch files contained metadata of forensic interests are:

  • Executable file name (Unicode),
  • Last Executed Timestamp,
  • Executed Count, abd
  • Volume ID.

Notable mentions to Prefetch forensic articles are:

Further to that, you will probably find many tools and articles on Prefetch file analysis. So I am just going to write only very briefly on it.

Prefetch files can be found at c:\Windows\Prefetch\ folder. For the purpose of this post, I will only focus on the file articles with the ‘pf’ extension.

Windows XP

  • OS Version: Offset 00, length of 4 bytes (LE)
    • 0x00000011: Windows XP
  • File header: Offset 04, length of 4 bytes
    • SCCA (0x53, 0x43, 0x43, 0x41)
  • Unicode filename: Offset 16, length of 30 bytes
  • Last executed time: Offset 128, length of 8 bytes (LE), Windows Filetime format
  • Executed count: Offset 144, length of 4 bytes (LE)
  • VolumeID:
    • Reference to Forensicwiki, Offset 108, length of 4 bytes points to the offset of section D of the prefetch file.
    • Volume ID is located at Offset of section D + 16 bytes, for a length of 4 bytes

Windows Vista

  • OS Version: Offset 00, Length of 4 bytes (LE)
    • 00000017: Windows Vista
  • File header: Offset 04, Length of 4 bytes
    • SCCA (0x53, 0x43, 0x43, 0x41)
  • Unicode filename: Offset 16, Length of 30 bytes
  • Last executed time: Offset 128, Length of 8 bytes (LE), Windows Filetime format
  • Executed count: Offset 152, length of 4 bytes (LE)
  • VolumeID:
    • Reference to Forensicwiki, Offset 108, length of 4 bytes points to the offset of section D of the prefetch file.
    • Volume ID is located at Offset of section D + 16 bytes, for a length of 4 bytes

Windows 7

  • OS Version: Offset 00, Length of 4 bytes (LE)
    • 00000017: Windows 7
  • File header: Offset 04, Length of 4 bytes
    • SCCA (0x53, 0x43, 0x43, 0x41)
  • Last executed time: Offset 128, Length of 8 bytes (LE), Windows Filetime format
  • Executed count: Offset 152 length of 4 bytes (LE)
  • VolumeID:
    • Reference to Forensicwiki, Offset 108, length of 4 bytes points to the offset of section D of the prefetch file.
    • Volume ID is located at Offset of section D + 16 bytes, for a length of 4 bytes

Windows 8

  • OS Version: Offset 00, Length of 4 bytes (LE)
    • 0000001A: Windows 8
  • File header: Offset 04, Length of 4 bytes
    • SCCA (0x53, 0x43, 0x43, 0x41)
  • Last executed time: Offset 128, Length of 8 bytes (LE), Windows Filetime format
    • According to my colleagues (JS and TB), Prefetch captured the last 8 executed time starting at offset 128. Each record is stored in Windows Filetime format.
  • Executed count: Offset 208, length of 4 bytes (LE)
  • VolumeID:
    • Reference to Forensicwiki, Offset 108, length of 4 bytes points to the offset of section D of the prefetch file.
    • Volume ID is located at Offset of section D + 16 bytes, for a length of 4 bytes.

I wrote a simple EnScript to parse the Prefetch data and have tested it on limited numbers of prefetch files. This EnScript will parse Prefetch files with the file signature “SCCA”. The mode of operating the EnScript is illustrated in the following image:

prefetch 001

Once the EnScript is run successfully, the output will save in the specified output file.

prefetch 002

Link for Prefetch Parser 0.2

This EnScript is tested on limited number of Prefetch files. If you have any question or clarification or you find any bug, please contact me at davidkoepi – gm ail


UserAssist Forensic

Recently, I have been spending a little more time on EnScript. I did a simple Enscript to parse UserAssist registry key. There have been many good references on UserAssist. Notable mentioned are:

In a statement, UserAssist keep track of the applications ran by the users and stored them in the NTUSER.DAT registry. The data is then used to display the frequently used program in Windows. UserAssist registry key on Windows XP, Vista, 7 and 8 is located at NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\[GUID]\Count\. Using a limited set of registry files and references, the respective OS and the UserAssist’s GUID are as follows:

Windows XP

  • {75048700-EF1F-11D0-9888-006097DEACF9}
  • {5E6AB780-7743-11CF-A12B-00AA004AE837\}

Windows Vista

  • {75048700-EF1F-11D0-9888-006097DEACF9}
  • {5E6AB780-7743-11CF-A12B-00AA004AE837}

Windows 7

  • {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}
  • {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}

Windows 8

  • {FA99DFC7-6AC2-453A-A5E2-5E2AFF4507BD}
  • {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}
  • {F2A1CB5A-E3CC-4A2E-AF9D-505A7009D442}
  • {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}
  • {CAA59E3C-4792-41A5-9909-6A6A8D32490E}
  • {B267E3AD-A825-4A09-82B9-EEC22AA3B847}
  • {A3D53349-6E61-4557-8FC7-0028EDCEEBF6}
  • {9E04CAB2-CC14-11DF-BB8C-A2F1DED72085}

Registry Name are encoded using ROT13 algorithm. Registry Value are stored in binary value. The registry value of discussion are the:

  • 16 bytes values on Windows XP and Vista,
  • 72 bytes values on Windows 7 and 8,
  • Other sizes of registry values exists on the system but there is not the point of this discussion.,
  • Detailed reference can be referred to

Registry Values of forensic interest are:

  • Last executed time in 8 bytes Filetime value,
  • Executed counts

So I using my amateurish programming skill and wrote a simple EnScript. The Enscript work is as follows:

  • Ability to parse UserAssist registry key on Windows XP, Vista, 7 and 8,
  • Parse all selected registry files (NTUSER.DAT),
  • Dialog box to specify destination folder,
  • Output file in TSV format, FileID of the selected file is appended to the output file,
  • Determine the OS version using the buildnumber registry value (NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and based on the reference,
  • Based on the OS Version, it will parse the registry value based on the respective OS’s GUID,
  • Check the registry value size (16 or 72 bytes) and parse the value for “last executed time” and “executed count”.


userassist 002

The EnScript is coded and test on EnCase version 7.0.7. The EnScript is tested based on a small set of Registry files. The EnScript can be downloaded at Link. If you find any bug, please contact me. Thank You!!

UserAssist Parser 0.1

iPhoto Forensic on Mac OS X (10.8)

According to Wikipedia, iPhoto is a digital image manipulating software application and is installed on all Mac OS X as part of the iLife digital multimedia management applications. iPhoto can import, edit, organize and print digital photos.

The iPhoto preferences and settings named “” is stored in ~/Library/Preferences/. Notable settings includes:

Recent iPhoto  Library folder path

Screen Shot 2013-07-26 at 11.34.14 PM


Screen Shot 2013-07-26 at 11.40.03 PM

Path of album folder

Screen Shot 2013-07-26 at 11.41.53 PM

Online account sharing: Username and Service

Screen Shot 2013-07-27 at 9.06.00 AM

Another notable Plist file is ~/Library/Preferences/iApps.plist which detailed the last opened iPhoto Library

Screen Shot 2013-07-27 at 6.57.31 PM

Default path for iPhoto library is ~/Pictures/iPhoto Library.photolibrary. It is also possible that multiple iPhoto Library may be present on the system. On a Mac, the iPhoto Library appears as a single file but it is a folder containing the photos and metadata files of the library files. To explore the contents, you can right-click on the file and select “Show Package Contents”.

Screen Shot 2013-07-27 at 9.43.51 AM

One of the way is to copy the iPhoto library file to your Mac Forensic workstation. Use “Switch” to analyse the images and metadata or information attached to the albums/images.

Screen Shot 2013-07-27 at 6.26.14 PM

Version of iPhoto can be found in a file named “info.plist” in the Library folder.

Screen Shot 2013-07-27 at 7.01.10 PM

Images imported into iPhoto are placed in 3 of the folders in the iPhoto Library:

  • Masters (imported images)
  • Previews (edited images)
  • Thumbnails (thumbnail of images)

Images are placed in the folders created with respect to YYYY\MM\DD\YYYYMMDD-hhmmss.

Screen Shot 2013-07-27 at 2.48.27 PM

Another file of interest is AlbumData.xml which contained metadata pertaining to the photo albums, such as the album name and number of images.

Screen Shot 2013-07-27 at 6.37.24 PM

Screen Shot 2013-07-27 at 6.39.32 PM


Plist View using Plist Viewer Plugin EnScript

Just completed my EnCase training and was playing around in my free time on EnCase 7.07. I must say the training received did help me out in navigating the complicated features in EnCase must better. This post is not about EnCase but I find the “Plist Viewer Plugin” EnScript useful for doing MacForensic using EnCase. You can download the EnScript file on I tried out this EnScript on a handful of Plist files and here is one of the output.


In case you want to know. I am not in anyway associate with Guidance Software or their products. I just want think it is a pretty good EnScript if you are working on MacForensic on a Windows. Do let me know if you find any tools to do it better. And don’t send me any “hate” comments how much you feel about it. Good Day! : ) I am still exploring the 30+ EnScript I had downloaded.

Mac Forensic Part 6 (Mountain Lion 10.8 – Logs)

Application Firewall

  • /private/var/log/appfirewall.log
  • /private/var/log/appfirewall.log.[x].bz2

System Logs

  • /private/var/log/asl/YYYY.MM.DD.U[XX].asl
  • /private/var/log/DiagnosticMessages/YYYY.MM.DD.asl
  • /private/var/log/install.log
  • /private/var/log/install.log.[x].bz2
  • /private/var/log/opendirectoryd.log
  • /private/var/log/opendirectoryd.log.[x].bz2
  • /private/var/log/system.log
  • /private/var/log/system.log.[x].bz2
  • /private/var/log/vnetlib
  • /private/var/log/weekly.out
  • /private/var/log/zzz.log

Last shutdown logs

  • /private/var/log/
  • /private/var/log/

System setup information (if available)

a. wirelessconnection
b. registered country and city
c. firmware version at logged time
d. created username
e. Install apps

  • /private/var/log/install.log

Disk status (at logged time)

  • /private/var/log/daily.out MAC address/


Network Status (at logged time)

  • /private/var/log/daily.out


Connecting USB Device
(Look for “USBMSC”)

  • /private/var/log/System.log


Bootup time
(Look for “BOOT_TIME”)

  • /private/var/log/System.log


Proper Shutdown time
(Look for “SHUTDOWN_TIME”)

  • /private/var/log/System.log


User’s Logs

  • ~/Library/Logs/AMRestore.txt
  • ~/Library/Logs/appstore.log
  • ~/Library/Logs/DiagnosticReports/
  • ~Library/Logs/SMSMigrator/SMSMigrator.log
  • ~/Library/Logs/sync/syncservices.log
  • ~/Library/Logs/Ubiquity/[User]/ubiquity-digest.log
  • ~/Library/Logs/Ubiquity/[User]/ubiquity.log

Disc burning log

  • ~/Library/Logs/DiskRecording.log


Disk Utility log

  • ~/Library/Logs/DiskUtility.log


File system log

  • ~/Library/Logs/fsck_hfs.log


  • ~/Library/Logs/VMWare
  • ~/Library/Logs/VMWare Fusion/


Mac Forensics Part 5 (Mountain Lion 10.8 – User Profile)

User Default Folder

  • Deleted files (Trash bin): ~/.Trash/
  • Desktop files: ~/Desktop/
  • Document folder (default): ~/Documents/
  • Download folder (default): ~/Downloads/
  • Library – configurations and settings: ~/Library/
  • Movies folder (default): ~/Movies/
  • Music folder (default): ~/Music/
  • Public – file sharing, if it is enabled: ~/Public

User Profile Artifacts

Bash command history

  • ~/bash_history

SSH connection detail:

  • ~/.ssh/known_hosts

Settings for Apps to access contacts

  • ~/Library/Application Support/

CrashReporter – Apps crashed timestamp

  • ~/Library/Application Support/CrashReporter/[App]_[GUID].plist


CrashReporter – Crash count

  • ~/Library/Application Support/User_Crash_History_[GUID].plist


Dock – Apps appear/Keep in Dock

  • ~/Library/Application Support/Dock/[GUID].db

Notification Center

  • ~/Library/Application Support/NotificationCenter/[GUID].db

Sandbox container

  • ~/Library/Containers/

Keychains (User)

  • ~/Library/Keychains/
  • ~/Library/Keychains/login.keychain
  • ~/Library/Keychains/metadata.keychain
  • ~/Library/Keychains/[XXXX].keychain

LaunchAgents (User)

  • ~/Library/LaunchAgents/[App].plist


Quicktime – URL to online multimedia

  • ~/Library/Caches/Quicktime/downloads/TOC.plist


Recent folders

  • ~/Library/Preferences/



  • ~/Library/Preferences/.GlobalPreferences.plist


AppStore – available update

  • ~/Library/Preferences/


Recent disk image (ISO/DMG)

  • ~/Library/Preferences/


Dock – Persistent apps

  • ~/Library/Preferences/


Dock – Other persistent items

  • ~/Library/Preferences/


Dashboard – gadget/widget

  • ~/Library/Preferences/


Recent Applications * Default is 10

  • ~/Library/Preferences/


Recent Documents * Default is 10

  • ~/Library/Preferences/



  • ~/Library/Preferences/


Screensaver – Password enabled

  • ~/Library/Preferences/


Finder Sidebar

  • ~/Library/Preferences/


  • ~/Library/Preferences/


  • ~/Library/Printers/

Connected iDevices

a) Type of device
b) Last connected timestamp
c) Firmware version
d) Serial number and IMEI

  • ~/Library/Preferences/ Connected storage ~/Library/Preferences/


Connected storage

  • ~/Library/Preferences/


Flash Cookies

  • ~/Library/Preferences/Macromedia/Flash Player/

Last Used Printers

  • ~/Library/Preferences/org.cups.PrintingPrefs.plist


Preview – Recent Documents

  • ~/Library/Preferences/


Quicktime – Recent documents

  • ~/Library/Preferences/


Console – Recent documents

  • ~/Library/Preferences/


Textedit – Recent documents

  • ~/Library/Preferences/


Saved Application Stated

– folders of application’s saved state

  • ~/Library/Saved Application State/


  • ~/Library/PubSub/Database/Database.sqlite3
  • ~/Library/PubSub/Clients.plist
  • ~/Library/PubSub/Feeds/

Spotlight folder

  • ~/.Spotlight-V100/

Download Quarantine Events

  • ~/Library/Preferences/


Mac Forensics Part 4 (Mountain Lion 10.8 – System File Artifacts)

OS Version:

  • /System/Library/CoreServices/SystemVersion.plist



  • /Library/Preferences/.GlobalPreferences.plist



  • /Library/Preferences/.GlobalPreferences.plist


MAC Address:

  • /private/var/log/daily.out


Startup Folders:

  • /Library/LaunchAgents/
  • /Library/LaunchDaemons/
  • /System/Library/LaunchAgents/
  • /System/Library/LaunchDaemons/

System Preferences Apps:

  • /Library/PreferencePanes/


  • /Library/Preferences/



  • /Library/Preferences/



  • /Library/Preferences/


Last User Logged In:

  • /Library/Preferences/


Last Update

  • /Library/Preferences/


Time Machine:

Last Backup , Oldest Backup, No of snapshot

  • /Library/Preferences/


Time Machine – Snapshots:

  • /private/var/db/



  • /Library/Preferences/org.cups.printers.plist

Airport – Remembered Network:

  • /Library/Preferences/SystemConfigurations/


Last Sleep Time:

  • /Library/Preferences/SystemConfigurations/


Network Interface Name:

  • /Library/Preferences/SystemConfigurations/NetworkInterfaces.plist


Network Information:

  • /Library/Preferences/SystemConfigurations/preferences.plist



  • /Library/Preferences/SystemConfigurations/preferences.plist


VMWare Fusion Network:

  • /Library/Preferences/VMWare Fusion/networking



  • /Library/Keychains/ /System/Keychains/

Host file:

  • /private/etc/hosts Path /private/etc/paths


  • /private/etc/resolv.conf

User’s account:

  • /private/var/db/dslocal/nodes/[user].plist

User’s account – picture:

  • /private/var/db/dslocal/nodes/[user].plist


User’s account – password hint:

  • /private/var/db/dslocal/nodes/[user].plist


User’s account:

Realname (full name) – name – UID – GID

  • /private/var/db/dslocal/nodes/[user].plist



Members and GID

  • /private/var/db/dslocal/nodes/[group].plist


* admin.plist for admin user * staff.plist for root user

Hibernation file:

  • /private/var/vm/sleepimage

Swap file:

  • /private/var/vm/swapfile[x]

Installed Printers:

  • /Library/Printers/
  • /Library/Printers/InstalledPrinters.plist



Mac Forensic Part 3 (Filesystem)

Supported Filesystem in Mac OS X

HFS Plus or HFS+ is a file system developed by Apple Inc and is the primary file system used in Macintosh computers. Another version of HFS Plus called HFSX is introduced in OS X 10.3.

MAC OS X support the following filesystem:

  • Read/Write:
    • Mac OS X Extended (Journaled)
    • Mac OS X Extended (Journaled, Encrypted)
    • Mac OS X Extended (Case-sensitive, Journaled)
    • Mac OS X Extended (Case-sensitive, Journaled, Encrypted)
    • MS-DOS (FAT)
    • ExFat
  • Read Only:
    • NTFS

Partition in OS X

There are 3 choices of partitioning in OS X:

  • GUID Partition Table (GPT), primarily used in Intel-based Mac. GPT uses Extensible Firmware Interface (EFI) in place of a BIOS
  • Apple Partition Map, mainly used in PowerPC based MAC
  • Master Boot Record (MBR) for Windows compatibility system


Files in HFS are made up of 2 parts; data fork and resource fork. Data fork contains the actual data of the file. Resource fork contain information of the file. Resource fork may contain icon, metadata, preferences and application code. Volumes in HFS are divided into 512-byte logical blocks. A group of 8 blocks is known as an allocation block.

Like NTFS, HFS also use metadata files to keep track of the volume:

  • Volume header: information of the volume; total files, size of allocation table, number of allocation block and write-protected status.
  • Catalog File: keep track of folders and files on the volume
  • Extents overflow: hold the location of the extents that are greater than 8.
  • Allocation File: keep track of the allocation block on a volume
  • Attributes File: Used to store extended metadata attributes and additional files’ forks.

Folders in OS X

The key folders are as follows:

  • Applications/: Default folder for applications
  • Library/: Contained OS X files and supported operating system items for system global functionality and apply to all users. Network/: Network domain, open directory or active directory
  • System/: Reserved for OS X System files and contained items such as system setup and functionality of the system
  • Users/: Home folders for local users. There will also be a “Public” folder for sharing of files between users.
  • .DocumentRevisions/: Contain files of previous versions of documents. (Root access only)
  • .fseventsd/: Logging of filesystem events. (Root access only)
  • .Trashes (Empty)
  • mach_kernel:  OS X Mach kernel
  • etc or private/etc/: Configurations and other system files
  • private/sbin/: Linux-styled binaries for admin
  • var/ or private/var
  • Volumes/: Mounted devices such as harddisk, CD, DMG and USB drives.

Mac Forensics Part 2 (Acquisition)

Method 1: Remove harddisk and image harddisk using forensic equipments/software.

  • Advantage: This is generally accepted method for all systems. Imaging using this method can be applied using all common forensic equipments/software.
  • Drawback: Require to disassemble the system. Apple are using custom screws on some of their models. To add on, Apple is using a different SSD connector for it’s MacBook Air model [Link].

Method 2: Forensic Linux Boot CD.

  • Advantage: Many options are available (eg Sumuri’s Paladin). Typically, Read-only are enable on boot for all storage media.
  • Drawback: Remember to test (and retest) before using it. Some Linux CDs are not updated frequently or lack drivers supports. One limitation is that some Linux CD do not provide imaging to a NTFS or HFS partition.

Method 3: Target Disk Mode

  • Advantage:Allow a Mac to turn into an external harddisk. Quick and easy way to image the harddisk without opening the system. Allow ‘field mode’ or instantly view artifacts on a Mac before imaging.
  • Drawback: FireWire Target Disk Mode works on internal PATA or SATA drives only. Target Disk Mode only connects to the master PATA drive on the Ultra ATA bus. It will not connect to Slave ATA, ATAPI, or SCSI drives [Link]. Remember to put device into write-block mode!!

Method 4: Commercial Mac Imaging Tool

  • Advantage: Most tools are generally work well for most models. Supports and bug-fix are usually promptly.
  • Drawback: Remember to test these tools on the latest Mac you can lay your hands on. Usually take awhile before upgrades are available.

As a rule of thumb, a good forensic examiner must be armed with more than one method to image a system, especially when you are on the field. This is also important to monitor upgrades, test (retest) and keep on open mind to try out new methods/tools. Do let me know if you have new methods. Thanks!!

Mac OS X Start up command

  • Available Startup Option: (Hold) Option
  • Boot from CD: (Hold) C
  • Target Disk Mode: (Hold) T
  • Start in Hardware Test Mode: (Hold) D
  • Force Mac to startup: (Hold) X
  • Safe Boot Mode: (Hold) Shift
  • Network Boot: (Hold) N
  • Bypass primary startup volume: Option + Command + Shift + Delete
  • Reset PRAM and NVRAM: Option + Command + P + R
  • Verbose Boot: (Hold) Command + V
  • Single User Mode: (Hold) Command + S
  • Start in Recovery: (Hold) Command + R
  • Eject CD: Hold mouse button, or Fn + F12, Eject button

Common Shortcut in Mac OS X system

  • Right Click: Control + Mouse Click
  • Switch applications: Command + Tab
  • Screen Capture (Full): Command + Shift + 3
  • Screen Capture (Selective): Command + Shift + 4
  • Screen Capture (Windows): Command + Shift + 4 + spacebar
  • Close Window: Command + W
  • Hide Finder: Command + H
  • Save: Command + S
  • Print: Command + P
  • Show Info: Command + I
  • Connect to Server: Command + K
  • Copy: Command + C
  • Paste: Command + V
  • Quit Application: Command + Q

Mac Forensics Part 1

Just completed my work on Mac Forensic. I decided to remove the previous “mini-series” and re-post my work.

OS X is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc. It is designed to run exclusively on Mac computers. Version of OS X releases:

  • Rhapsody Developer Release – 31 Aug 1997
  • Mac OS X Server 1.0 (Hera) – 16 Mar 1999
  • Mac OS X Developer Preview – 16 Mar 1999
  • Public Beta (Kodiak) – 13 Sep 2000
  • Mac OS X 10.0 (Cheetah) – 24 Mar 2001
  • Mac OS X 10.1 (Puma) – 18 Jul 2001
  • Mac OS X 10.2 (Jaguar) – 6 May 2002
  • Mac OS X 10.3 (Panther) – 23 Jun 2003
  • Mac OS X 10.4 (Tiger) – 4 May 2004
  • Mac OS X 10.5 (Leopard) – 26 Jun 2006
  • Mac OS X 10.6 (Snow Leopard) – 9 Jun 2008
  • Mac OS X 10.7 (Lion) – 20 Oct 2010
  • Mac OS X 10.8 (Mountain Lion) – 16 Feb 2012

* source from

OS X originally was developed and ran on PowerPC-based Macs. In 2006, Macs developed a version of OS X 10.4 for ‘Intel’ system. In 2007, 10.5 “Leopard” was first to run on both PowerPC and Intel Macs. OS X 10.6 (Snow Leopard) was the first version of OS X to replace PowerPC Macs with Intel Macs. Mac OS X 10.7 “Lion” was the first version of OS X to drop support for 32-bit Intel processors and run on 64-bit Intel CPUs.

Mac Products (as of Mar 2013)

  • MacBook Air 11 inch (default with 64 GB /128GB SSD)
  • MacBook Air 13 inch (default with 128GB/ 256GB SSD)
  • MacBook Pro 13 inch (default with 500GB/ 750GB HDD)
  • MacBook Pro 15 inch (default with 500GB HDD)
  • MacBook Pro 13 inch Retina Display (default with 128GB/ 256GB SSD)
  • MacBook Pro 15 inch Retina Display (default with 256GB/ 512GB SSD)
  • Mac Mini (default with 500GB/1TB HDD, or 2X1TB HDD)
  • iMac 21.5 inch (default with 1TB HDD)
  • iMac 27 inch (default with 1TB HDD)

** for more details, please refer to

Apple products also includes “Mac Pro” computers and a variant of “Mac Mini” running OS X server operating system. There is also a hacking project to run OS X on non-apple computer computers and these computers are known as “Hackintosh”. However this is not licensed by Apple and may be illegal in some countries.