Blog

Update:  BlackLight 2019 R3 parses Unified Logs.  For more information see https://www.blackbagtech.com/blog/making-sense-of-unified-logs. Starting with the release of macOS Sierra 10.12, Apple began changing over to a...

With the latest release of the new Apple MacBook Pros with USB-C, we’re excited to announce MacQuisition now includes an Apple USB-C to USB adapter...

In our last blog we laid the foundations of what the Registry is, and how it is structured.  In this blog we are going to...

The Windows Registry is a centralized hierarchical database that contains both system and user information and settings for Windows computers.  These settings can be anything...

As many well know, Apple and Microsoft products are not always easily compatible. We have discovered that some Apple emojis found on Mac OS X...

Collecting and analyzing RAM on a Mac is, not surprisingly, different than it is on a Windows machine.  Tools like MacQuisition can assist examiners in...

Analyzing the contents of RAM has been a hot button topic for some time now.  It makes sense in a lot of ways, after all...

Windows 10 Jump List Forensics: When Microsoft released Windows 7, a new artifact was released to the forensic world, Jump Lists.  Since that time most examiners...

With the proliferation of cheap external USB devices, it is becoming incumbent on examiners to determine if any USB attached storage has connected to the...

Next up in our Windows Forensic Essentials Blog Series is a look at Volume Shadow Copies. Looking for other blog posts in this series? We have...