Mac Admins Podcast, Episode 52: Digital Forensics on the Mac with Sarah Edwards
In the 52 episode of Mac Admins Podcast Sarah Edwards talks about Digital Forensics on the Mac, and using system tools, spec…
Decision-Theoretic File Carving
This article explores a novel approach to file carving by viewing it as a decision problem. This allows us to design algorit…
The Sleuth Kit 4.4.2 and Autopsy 4.4.1 have been released
New versions of your favourite open source DFIR tools – the Sleuth Kit and Autopsy, – have been released. The Sl…
Finding the Serial Number of a Mac from Disk Image
Yogesh Khatri has published a very useful post – he shows how to find the serial number of a Mac computer or laptop. T…
Mac MRU Parser – Spotlight Shortcuts & BLOB Parsing
Sarah Edwards has updated her Mac MRU Parser. Now it parses the Spotlight Shortcuts plist and also the Bookmark and Alias BL…
macOS forensic tools: HFS Journal Parser
HFS Journal Parser finds and parses catalog file record in HFS+/HFSX .journal file. Â It has searching capabilities, allows t…
Mac RAM Imaging and Analysis
BlackBag Training Team has published a post about Mac memory imaging and analysis. They start from different ways of capturi…
The Cider Press: Extracting Forensic Artifacts from Apple Continuity
Heather Mahalik and Sarah Edwards shared their fresh presentation from SANS DFIR Summit on extracting forensic artifacts fro…
Adding AFF4 support to The Sleuth Kit and Volatility on macOS
AFF4 (Advanced Forensics File Format v4.0) is the new standard in forensic imaging, a new container format for storing digit…
Apple FSEvents Forensics
Nicole Ibrahim has published a post on FSEvents forensics. In this post she is covering a high-level overview of Apple FSEve…
