Consultants

In part one of this blog series we covered the many ways a Mac forensic examiner may view .plist files using both Apple and third-party...

With the introduction of Mac OS X (10.6) Snow Leopard, the OS X operating system began logging USB device connections. Mac forensic examiners may locate...

Introduction Our Mac Forensics instructors spend a lot of time discussing preference list files, or .plist files, as these files are often valuable repositories for historical...

As we mentioned in part one of this blog, there are times when a forensic examiner must locate a Unique Identifier on an iPhone. If...

The guest user account on a Mac OS X machine is often overlooked. However, during a Mac forensic examination, an examiner may gain additional insight...

Over the years, our training curriculum and instructors have provided Mac Forensics students with many ways to collect detailed forensic evidence from a Mac OS...

Handheld device geo-location metadata  is extremely valuable to a forensic investigator attempting to prove a suspect’s whereabouts.  Looking back at my days as an investigator,...

There are times when a Forensic Examiner must locate a unique identifier on an iPhone. If the device is protected with an unknown pin or...

From time to time we like to revisit the basics! Whether you are new to Macintosh and iOS forensics and wish to build sound foundational...

with Maureen O'Neill I recently collaborated on a blog entitled “Mac E-Discovery in a Windows World: Apples to Apples?” with Discover Ready’s Senior Vice President, Employment...