Mac Forensics

By Stephanie Thompson, Solutions Engineer Portable case is a feature within Blacklight that allows for shareability of case data for offline review. Data needing to be...

by Stephanie Thompson, Solutions Engineer Keychains are encrypted containers used on macOS and iOS devices to store usernames and passwords, as well as confidential information such...

By: Bruce Hunter, Senior Forensic Engineer Starting with macOS 10.12 Apple changed to a new Unified Log format.  Rather than relying on one file to track...

With the release of BlackLight 2020 R1, BlackBag expanded the macOS artifacts processed.  By user request, features were added to process: AirDrop artifacts, built-in iCloud...

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac...

By: Sarah Edwards, Senior Digital Forensics Researcher While I was researching the Apple Notes application on macOS and iOS, I came across a peculiar scenarios where...

Today’s investigations often involve multiple machines and devices.  It can be time consuming to image and process several computers, external hard drives, and other media...

As Windows has evolved over time several artifacts have appeared that can highlight when programs or applications were executed, and which user executed them.  The...

By: Bruce Hunter, Senior Forensic Engineer With the release of macOS 10.12 Sierra, Apple introduced a new form of logging referred to as Unified Logs.  These...

By Stephanie Thompson, Solutions Engineer Using File Filters Data, data, and more data!!  With hard drives and mobile devices constantly increasing in size, investigators are always looking...