Chapter 8. Solutions in this chapter:
- Recovering Items from Web Cache
- Recovering Items from plist Files
- Summary
- Solutions Fast Track
- Frequently Asked Questions
Introduction
When a user surfs the Internet, traces of the search are left behind on the user's system. These traces contain very valuable information to a computer forensic investigator. Items such as browser cache and cookies can indicate what Web sites the user visited. Cookies are traces with user specific settings that are left behind on users' systems. Pictures are stored on the local system cache to speed up Web browsing. As an investigator, it is imperative that you are able to find the traces left on a machine from a user's browsing sessions.
Mac users tend to migrate toward ...
Get Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
