Chapter 7

OS X El Capitan forensics

Shawn Jordan    Marshall University, WV, USA


Apple’s OS X has a steady growth within the United States. This also means digital forensics laboratories will likely see more OS X products. This chapter looks at Mac OS X 10.11 El Capitan. The chapter begins at the top level or root directory, and it works down the file system. This chapter highlight areas of forensic interest. However, it also takes a basic look at the file system as a whole. This chapter gives the analyst a foundation in OS X. There is also a quick guide at the back of the chapter providing paths to key forensic information.


El Capitan
Mac forensics
OS X 10.11
Apple forensics


As Macintosh computers continue to ...

Get Digital Forensics now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.