01 · Acquisition & Triage
Apple Silicon Forensics: What M-Series Macs Change
How Apple Silicon changes Mac forensics: Secure Enclave, always-on storage encryption, Share Disk, boot security policy, SSV and acquisition strategy.
Read guide
Guides tagged: #dfir
06 · TCC & Keychain
macOS Keychain Forensics: Concepts and Metadata
Understand macOS keychains for DFIR: login and System keychains, the data protection keychain, iCloud Keychain, metadata value and legal limits.
Read guide
05 · Execution & Persistence
Investigating launchd Persistence on macOS
Find and analyze macOS persistence: LaunchAgents, LaunchDaemons, launchctl, Background Task Management (sfltool dumpbtm), cron, periodic and profiles.
Read guide
01 · Acquisition & Triage
macOS Forensic Acquisition: Live vs Dead-Box Triage
How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC.
Read guide
02 · Unified Logs
macOS Unified Logs Forensics: tracev3, log show, Predicates
Investigate macOS Unified Logs: tracev3 and uuidtext storage, log show predicates, logarchive collection, private redaction, retention and offline parsing.
Read guide
05 · Execution & Persistence
Quarantine Events and Gatekeeper: Tracing Mac Downloads
Decode the com.apple.quarantine xattr, query QuarantineEventsV2, and use spctl, codesign and unified logs to trace downloads and Gatekeeper decisions.
Read guide
04 · User Activity
Spotlight Forensics: Metadata Stores, mdls and Parsing
How to use the Spotlight index, mdls, mdfind and com.apple.metadata xattrs to recover download origins, usage counts and file history on macOS.
Read guide
06 · TCC & Keychain
TCC Database Forensics: macOS Privacy Permissions
Analyze macOS TCC.db privacy permissions: access table columns, service names, auth_value meanings, MDM grants, SIP protection and unified log evidence.
Read guide