Mac RAM Imaging and Analysis
BlackBag Training Team has published a post about Mac memory imaging and analysis. They start from different ways of capturi…
The Cider Press: Extracting Forensic Artifacts from Apple Continuity
Heather Mahalik and Sarah Edwards shared their fresh presentation from SANS DFIR Summit on extracting forensic artifacts fro…
Adding AFF4 support to The Sleuth Kit and Volatility on macOS
AFF4 (Advanced Forensics File Format v4.0) is the new standard in forensic imaging, a new container format for storing digit…
Apple FSEvents Forensics
Nicole Ibrahim has published a post on FSEvents forensics. In this post she is covering a high-level overview of Apple FSEve…
FSEParser v 2.1 released
New version of FSEventsParser has been released. FSEvents files are written to disk by OS X apis and contain historical reco…
Mac FS Events Parser for Autopsy
Mark McKinnon has written a plugin that will export the /.fseventsd directory to the temp folder and will then call an execu…
USB Device Tracking Artifacts on Linux and Mac OS X
Here is a nice cheat sheet by Forensic Proof, showing USB device tracking artifacts on Linux and Mac OS X: …
Are We Ready for Open Source Digital Forensics?
The art and science of reconstructing a chain of events on digital systems – has for a long time been dominated by commercia…
How far back does Sierra’s new log go?
Howard Oakley at The Eclectic Light Company has answered a simple question – how long does macOS Sierra retain entries…
