Law Enforcement

As has been previously noted, the BlackBag blog team is composed of several ex-law enforcement professionals with a dedication to sharing their knowledge with fellow...

FileVault is Apple’s "Full Disk Encryption" utility. When enabled, the contents of the entire HFS+ (Mac OS X) volume is encrypted with 256-bit encryption. The...

With Apple integrating numerous services between iOS and OS X devices, knowing that a user has an iCloud account can be invaluable in an investigation....

Shellbags are a set of registry keys that provide retention functionality with regards to Windows Explorer and a system user's activity. Shellbags essentially record when a...

Categorizer For All, or C4All, is a staple tool used worldwide in the investigation of child exploitation media. For those unfamiliar with this incredible resource,...

We recently created a video demonstrating how to image a FileVault 2-encrypted Fusion Drive with MacQuisition, BlackBag's versatile acquisition tool. What appears below is the...

We have some exciting news to share with our friends, customers, and partners.  Effective February 1, we have officially welcomed Vico Marziale and...

One aspect of digital forensics that merits specific attention for today's investigators is Apple's FileVault 2 encryption. FileVault 2 has become increasingly prevalent on OS...

There are many legitimate reasons why someone might wipe an iOS device.  A corporate IT administrator might do so prior to assigning a device to...

What time is it? The time is 3442503385. This number makes sense to our startup chiming Mac machinery (it is a Mac OS timestamp), but we’ve...