Mac Basics
It is important that you have a working understanding of the Macintosh operating system before attempting forensics. As with Linux, however, it is common for forensic examiners not to have a good working knowledge of Macintosh systems. The reason for this is simple: Most people have more exposure to Windows than to Macintosh. In fact, it is not uncommon to have a forensic examiner who has never even used a Macintosh. So this section first shows you the history of the Macintosh and then discusses the operating system fundamentals. This will establish a baseline of knowledge to help you understand Apple systems.
Mac History
Apple began with Steve Wozniak and Steve Jobs collaborating while working from their homes. In 1975, they ...
Get System Forensics, Investigation, and Response, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
