01 · Acquisition & Triage
macOS Forensic Acquisition: Live vs Dead-Box Triage
How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC.
01 · Evidence area
On modern Macs the storage is encrypted, the system volume is sealed and Apple Silicon ends classic physical imaging. This area covers live versus dead-box decisions, Full Disk Access, logical collection with Aftermath, mac_apt and UAC, and what changes on M-series hardware.
2 guides in this area
01 · Acquisition & Triage
How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC.
01 · Acquisition & Triage
How Apple Silicon changes Mac forensics: Secure Enclave, always-on storage encryption, Share Disk, boot security policy, SSV and acquisition strategy.
Where each artifact lives, what it proves, its timestamps and the tools to parse it.