Mac OS X Systems and Artifacts
Information in this Chapter
The first version of Mac OS X was released 10 years ago, and in the subsequent 10 years Apple has seen its fortune rise considerably. While not nearly as prevalent as Windows desktops and laptops, it is important that an examiner be prepared to deal with an OS X system if necessary. This chapter introduces the file system used by OS X, explains the layout of files and directories on the file system, and analyzes artifacts related to user and system activity.
The file system used by OS X is called HFS Plus or Mac OS Extended. HFS+ is the successor to the Hierarchical ...