Mac OS X Forensics

Philip Craiger; Paul Burke

doi:10.1007/0-387-36891-4_13

Mac OS X Forensics

Philip Craiger, Paul Burke

University of Central Florida

Research output: Chapter in Book/Report/Conference proceeding › Chapter

Abstract

This paper describes procedures for conducting forensic examinations of Apple Macs running Mac OS X. The target disk mode is used to create a forensic duplicate of a Mac hard drive and preview it. Procedures are discussed for recovering evidence from allocated space, unallocated space, slack space and virtual memory. Furthermore, procedures are described for recovering trace evidence from Mac OS X default email, web browser and instant messaging applications, as well as evidence pertaining to commands executed from a terminal.

Original language	American English
Title of host publication	Advances in Digital Forensics II
DOIs	https://doi.org/10.1007/0-387-36891-4_13
State	Published - Jan 2006
Externally published	Yes

Keywords

Macintosh computers
Mac OS X forensics

Disciplines

Computer and Systems Architecture
Forensic Science and Technology

Access to Document

10.1007/0-387-36891-4_13License: Unspecified

mac os xCraigerB06.pdfFinal published version, 5.26 MBLicense: Unspecified

Cite this

@inbook{cef53eace20c403eba90d612552fb59f,

title = "Mac OS X Forensics",

abstract = " This paper describes procedures for conducting forensic examinations of Apple Macs running Mac OS X. The target disk mode is used to create a forensic duplicate of a Mac hard drive and preview it. Procedures are discussed for recovering evidence from allocated space, unallocated space, slack space and virtual memory. Furthermore, procedures are described for recovering trace evidence from Mac OS X default email, web browser and instant messaging applications, as well as evidence pertaining to commands executed from a terminal.",

keywords = "Macintosh computers, Mac OS X forensics",

author = "Philip Craiger and Paul Burke",

year = "2006",

month = jan,

doi = "10.1007/0-387-36891-4_13",

language = "American English",

booktitle = "Advances in Digital Forensics II",

}

TY - CHAP

T1 - Mac OS X Forensics

AU - Craiger, Philip

AU - Burke, Paul

PY - 2006/1

Y1 - 2006/1

N2 - This paper describes procedures for conducting forensic examinations of Apple Macs running Mac OS X. The target disk mode is used to create a forensic duplicate of a Mac hard drive and preview it. Procedures are discussed for recovering evidence from allocated space, unallocated space, slack space and virtual memory. Furthermore, procedures are described for recovering trace evidence from Mac OS X default email, web browser and instant messaging applications, as well as evidence pertaining to commands executed from a terminal.

AB - This paper describes procedures for conducting forensic examinations of Apple Macs running Mac OS X. The target disk mode is used to create a forensic duplicate of a Mac hard drive and preview it. Procedures are discussed for recovering evidence from allocated space, unallocated space, slack space and virtual memory. Furthermore, procedures are described for recovering trace evidence from Mac OS X default email, web browser and instant messaging applications, as well as evidence pertaining to commands executed from a terminal.

KW - Macintosh computers

KW - Mac OS X forensics

U2 - 10.1007/0-387-36891-4_13

DO - 10.1007/0-387-36891-4_13

M3 - Chapter

BT - Advances in Digital Forensics II

ER -