Mark McKinnon has written a plugin that will export the /.fseventsd directory to the temp folder and will then call an executable program that will parse the data into a SQLite database and import it into Autopsy into the Extracted Content area. Learn more about the plugin here.

Load More Related Articles
Load More In Software

Leave a Reply

Your email address will not be published. Required fields are marked *