Mac Forensics

We recently created a video demonstrating how to image a FileVault 2-encrypted Fusion Drive with MacQuisition, BlackBag's versatile acquisition tool. What appears below is the...

One aspect of digital forensics that merits specific attention for today's investigators is Apple's FileVault 2 encryption. FileVault 2 has become increasingly prevalent on OS...

There are many legitimate reasons why someone might wipe an iOS device.  A corporate IT administrator might do so prior to assigning a device to...

What time is it? The time is 3442503385. This number makes sense to our startup chiming Mac machinery (it is a Mac OS timestamp), but we’ve...

In part one of this blog series, we covered ways a Mac forensic examiner may view .plist files using both Apple and third-party tools. Part...

In part one of this blog series we covered the many ways a Mac forensic examiner may view .plist files using both Apple and third-party...

With the introduction of Mac OS X (10.6) Snow Leopard, the OS X operating system began logging USB device connections. Mac forensic examiners may locate...

Introduction Our Mac Forensics instructors spend a lot of time discussing preference list files, or .plist files, as these files are often valuable repositories for historical...

As we mentioned in part one of this blog, there are times when a forensic examiner must locate a Unique Identifier on an iPhone. If...

The guest user account on a Mac OS X machine is often overlooked. However, during a Mac forensic examination, an examiner may gain additional insight...