Chapter 7. Macintosh Forensic Analysis
Imaging and File Systems353
Macintosh File Systems355
User Folders: Media Files371
User Folders: Applications372
Apple Macintosh computers running Mac OS X are in widespread use, and can pose a challenge for many digital forensic examiners. Lack of regular exposure to Macintosh systems as a source of evidence make it harder for digital forensic examiners to become adept at locating and interpreting useful information on these systems. Even forensic examiners with some familiarity with these systems may not be sufficiently conversant to perform a forensic ...