Chapter 12

Mac Forensics

Learning Outcomes

After reading this chapter, you will be able to understand the following:

  • The importance of Mac forensics;

  • The history of Apple devices;

  • Apple file systems: HFS, HFS+, and APFS;

  • Apple software and hardware encryption;

  • Virtual files on a Macintosh computer;

  • Property lists (PLists) and their value to investigators;

  • Applications and their associated files;

  • Hardware and software forensics tools for Macintosh computers and iOS devices; and

  • Examining Apple mobile devices.

Mac forensics has grown in importance in recent times. While Microsoft Windows-based computers still enjoy the majority of market share, especially in the corporate world, Macintosh computers have become more pervasive. The tremendous ...

Get A Practical Guide to Digital Forensics Investigations, 2nd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial