MacQuisition

Update:  BlackLight 2019 R3 parses Unified Logs.  For more information see https://www.blackbagtech.com/blog/making-sense-of-unified-logs. Starting with the release of macOS Sierra 10.12, Apple began changing over to a...

With the latest release of the new Apple MacBook Pros with USB-C, we’re excited to announce MacQuisition now includes an Apple USB-C to USB adapter...

Collecting and analyzing RAM on a Mac is, not surprisingly, different than it is on a Windows machine.  Tools like MacQuisition can assist examiners in...

Knowing specifically what a user has viewed on their computer is part of what an examiner does.  Determining whether or not a user has opened...

With Apple integrating numerous services between iOS and OS X devices, knowing that a user has an iCloud account can be invaluable in an investigation....

We recently created a video demonstrating how to image a FileVault 2-encrypted Fusion Drive with MacQuisition, BlackBag's versatile acquisition tool. What appears below is the...

One aspect of digital forensics that merits specific attention for today's investigators is Apple's FileVault 2 encryption. FileVault 2 has become increasingly prevalent on OS...

In part one of this blog series, we covered ways a Mac forensic examiner may view .plist files using both Apple and third-party tools. Part...

In part one of this blog series we covered the many ways a Mac forensic examiner may view .plist files using both Apple and third-party...

With the introduction of Mac OS X (10.6) Snow Leopard, the OS X operating system began logging USB device connections. Mac forensic examiners may locate...