OS X forensic acquisition: a basic workflow

OS X is, in effect, a *nix based system. Therefore the forensic image acquisition processes are very similar to those used on Linux systems.Today I’d like to share my personal acquisition workflow for Apple Mac systems. ‘Light’ evidence collection A first assessment could be performed with a ‘light’ acquisition tool,that gathers information from plists and […]