Chapter 11. Mac Forensics

Learning Outcomes

After reading this chapter, you will be able to understand the following:

Image The importance of Mac forensics;

Image History of Apple devices;

Image Apple file systems: HFS and HFS+;

Image Virtual files on a Macintosh computer;

Property lists (PLists) and their value to investigators;

Applications and their associated files; ...

Get A Practical Guide to Computer Forensics Investigations now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.