If you want to improve your Mac forensics skills, here is a very interesting and useful article by Jonathon Poling. It’s entitled “Mac Dumpster Diving – Identifying Deleted File References in the Trash (.DS_Store) Files” and will teach you how to identify deleted files references using .DS_Store. In the article Jonathon uses, among others, Sebastian Neef”s .DS_Store parser, so don’t forget to test it too.
Home How To Mac Dumpster Diving – Identifying Deleted File References in the Trash (.DS_Store) Files – Part 1
-
Volatility: Proxies and Network Traffic
Marcus Bakker from MB Secure has published a tutorial on how to catch malware beaconing fr… -
Forensic Review with Notepad++
In this post Hoyt Harness writes about how to add Plugin Manager to Notepad++ and make it … -
Make Your Debian a Forensic Workstation
If you are looking for a SIFT replacement and already have a Debian workstation, this pack…
Load More Related Articles
-
Forensic Review with Notepad++
In this post Hoyt Harness writes about how to add Plugin Manager to Notepad++ and make it … -
Extracting Data from a Samsung Device Using Advanced MTP
In this post Christopher Vance is writing about using advanced MTP to extract data from a … -
VMWare Incident Response: A Process
In the post the authors describe VMWare incident response process based on the following s…
Load More In How To
