Interested in Mac OS X and iOS Forensics? We are collecting and maintaining a list of mac4n6 resources.
OSXCollector – free Mac OS X forensics toolkit. What do you know about new Mac OS X Forensic Artifacts? MacOS Sierra (10.12) introduced a new logging mechanism called Unified Logging. This mechanism is used to piercing 10, tvOS watchOS 3 and 10 as well. Tips and Tricks.
The idea is to create one single point of collection for OS X and iOS artifacts location, trying to collect more information for each artifact, not just a path!
The motto? Reusable format.The goal is that the information collected have to be “machine parsable” and mostly “human readable/writable”, reusable by any application, library, etc. (am I too optimistic?). That is why as main collaboration tool for the collection, we use a shared spreadsheet so that anyone can add new artifacts, there is no need to know how to code to contribute to this project (so, no excuses!).From here, two (simple) scripts will convert the csv file into:
This way the effort is centralized and made only once.
Here is the shared spreadsheet for the OSX artifacts:
Here is the link to the ForensicsWiki page updated from the above spreadsheet
Mif filter for mac. Here is the shared spreadsheet for the iOS artifacts (way too much initial phase still):
Here you find some of the most interesting presentation on Mac OS X and iOS Forensics.
Lapack 3.8 0. If you are interested in contributing, please join us at https://groups.google.com/d/forum/mac4n6
Notice: The information collected will be made available under the Common Creatives 2.5 license http://creativecommons.org/licenses/by-sa/2.5/