Mac OS X Systems and Artifacts
Information in this Chapter
Introduction
The first version of Mac OS X was released 10 years ago, and in the subsequent 10 years Apple has seen its fortune rise considerably. While not nearly as prevalent as Windows desktops and laptops, it is important that an examiner be prepared to deal with an OS X system if necessary. This chapter introduces the file system used by OS X, explains the layout of files and directories on the file system, and analyzes artifacts related to user and system activity.
OS X File System Artifacts
The file system used by OS X is called HFS Plus or Mac OS Extended. HFS+ is the successor to the Hierarchical ...
Get Digital Forensics with Open Source Tools now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
