BlackLight

BlackLight parses out dates and times of iMessages and SMS messages, showing each message’s date sent, and perhaps date read and/or date delivered, depending on...

As has been previously noted, the BlackBag blog team is composed of several ex-law enforcement professionals with a dedication to sharing their knowledge with fellow...

FileVault is Apple’s "Full Disk Encryption" utility. When enabled, the contents of the entire HFS+ (Mac OS X) volume is encrypted with 256-bit encryption. The...

With Apple integrating numerous services between iOS and OS X devices, knowing that a user has an iCloud account can be invaluable in an investigation....

Shellbags are a set of registry keys that provide retention functionality with regards to Windows Explorer and a system user's activity. Shellbags essentially record when a...

What time is it? The time is 3442503385. This number makes sense to our startup chiming Mac machinery (it is a Mac OS timestamp), but we’ve...

In part one of this blog series, we covered ways a Mac forensic examiner may view .plist files using both Apple and third-party tools. Part...

In part one of this blog series we covered the many ways a Mac forensic examiner may view .plist files using both Apple and third-party...

With the introduction of Mac OS X (10.6) Snow Leopard, the OS X operating system began logging USB device connections. Mac forensic examiners may locate...

Introduction Our Mac Forensics instructors spend a lot of time discussing preference list files, or .plist files, as these files are often valuable repositories for historical...