Blog

What time is it? The time is 3442503385. This number makes sense to our startup chiming Mac machinery (it is a Mac OS timestamp), but we’ve...

One of our top tech support questions is “Are iOS device passcodes different than iOS backup passwords?” The answer is ‘yes’, and this blog seeks...

The BlackLight forensic analysis software includes two very powerful metadata file filters that allow forensic analysts to quickly isolate data on iPhone and iPad devices...

In part one of this blog series, we covered ways a Mac forensic examiner may view .plist files using both Apple and third-party tools. Part...

In part one of this blog series we covered the many ways a Mac forensic examiner may view .plist files using both Apple and third-party...

With the introduction of Mac OS X (10.6) Snow Leopard, the OS X operating system began logging USB device connections. Mac forensic examiners may locate...

Introduction Our Mac Forensics instructors spend a lot of time discussing preference list files, or .plist files, as these files are often valuable repositories for historical...

As we mentioned in part one of this blog, there are times when a forensic examiner must locate a Unique Identifier on an iPhone. If...

The guest user account on a Mac OS X machine is often overlooked. However, during a Mac forensic examination, an examiner may gain additional insight...

Over the years, our training curriculum and instructors have provided Mac Forensics students with many ways to collect detailed forensic evidence from a Mac OS...