Chapter 7. Macintosh Forensic Analysis
Anthony Kokocinski
Contents
Introduction353
Imaging and File Systems353
Macintosh File Systems355
Property Lists359
User Accounts359
Applications364
System365
User Folders370
User Folders: Media Files371
User Folders: Applications372
Wrap Up382
References382
Introduction
Apple Macintosh computers running Mac OS X are in widespread use, and can pose a challenge for many digital forensic examiners. Lack of regular exposure to Macintosh systems as a source of evidence make it harder for digital forensic examiners to become adept at locating and interpreting useful information on these systems. Even forensic examiners with some familiarity with these systems may not be sufficiently conversant to perform a forensic ...
Get Handbook of Digital Forensics and Investigation now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
