Apple Pattern of Life Lazy Output’er (APOLLO)
Sarah Edwards presented a new tool called APOLLO or Apple Pattern of Life Lazy Output’er. The tool was presented at Ob…
Beyond good ol’ LaunchAgent – part 0
Pasquale Stirparo has started a post series about macOS persistense mechanisms titled “Beyond good ol’ LaunchAge…
Parsing APFS with Magnet AXIOM
Despite the fact APFS isn’t currently supported by AXIOM, the author of “The Swanepoel Method” blog ran a …
Apple File System (APFS) – Acquisition, Decryption and Analysis
During this webinar BlackBag Technologies representatives will show you how to acquire, decrypt and analyze APFS volumes: …
Consolation – a log browser for macOS Sierra and High Sierra
Consolation provides an accessible but powerful way to browse, search, and analyse entries in the new log system which have …
Mac OS X Forensics
Market share of the Apple computers are continuously increasing day by day and Apple provides an OS X as a default operating…
Reading Notes database on macOS
Yogesh Khatri has recently posted about forensicating Notes database on macOS. He shows locations of coresponding databases …
Detection of Backdating the System Clock in macOS
Recently we have received a good question from one of our DFIR mates: “How can one detect backdating of the system clo…
Mounting an APFS image in Linux
Here is another post by Another Forensics Blog (Mari Degrazia) about mounting Apple File System (APFS). This time you will l…
How to Mount Mac APFS Images in Windows
In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon has …
