Category: DFIR

macOS Forensics Artifacts and Commands

When conducting a digital forensic investigation on macOS systems, understanding where to find critical artifacts and how to extract meaningful data is crucial. Unlike Linux, macOS uses unique system components and logging mechanisms that require specialized knowledge. This post highlights … Read the rest

Cloud Chain of Custody

This post is focused on the Chain of Custody in general and some of the implications of the Cloud. If you are looking for CoC scenarios and how they affect the Cloud, the following post will discuss handling the Chain … Read the rest