Mac Forensics

BlackLight 2017 R1 brings improved exporting of evidence to the LACE, Project VIC and C4All data models. By providing integrated support for exporting to these...

The known, safe and trusted hash sets from over 100 Mac OS X, macOS, and Microsoft Windows operating system versions have been updated in the...

One interface. All four major platforms Flexible, intuitive and easy to use LACE, ProjectVIC and C4All data models Save time and resources Training and...

Update:  BlackLight 2019 R3 parses Unified Logs.  For more information see https://www.blackbagtech.com/blog/making-sense-of-unified-logs. Starting with the release of macOS Sierra 10.12, Apple began changing over to a...

As many well know, Apple and Microsoft products are not always easily compatible. We have discovered that some Apple emojis found on Mac OS X...

Collecting and analyzing RAM on a Mac is, not surprisingly, different than it is on a Windows machine.  Tools like MacQuisition can assist examiners in...

Analyzing the contents of RAM has been a hot button topic for some time now.  It makes sense in a lot of ways, after all...

Knowing specifically what a user has viewed on their computer is part of what an examiner does.  Determining whether or not a user has opened...

How and where the BlackLight case is stored has a direct effect on performance.  Even the fastest workstation will benefit from this simple concept of...

The release of iPhone 7, iPhone 7 Plus, and iOS 10, brings new challenges for the digital forensic community. With the constant stream of new...