01 · Acquisition & Triage
macOS Forensic Acquisition: Live vs Dead-Box Triage
How to acquire evidence from a Mac: live vs dead-box, FileVault, Full Disk Access, SIP, order of volatility, and triage with Aftermath, mac_apt and UAC.
Read guide
01 · Evidence area
Acquisition & Triage
On modern Macs the storage is encrypted, the system volume is sealed and Apple Silicon ends classic physical imaging. This area covers live versus dead-box decisions, Full Disk Access, logical collection with Aftermath, mac_apt and UAC, and what changes on M-series hardware.
- Aftermath
- mac_apt
- UAC
- log collect
2 guides in this area
01 · Acquisition & Triage
Apple Silicon Forensics: What M-Series Macs Change
How Apple Silicon changes Mac forensics: Secure Enclave, always-on storage encryption, Share Disk, boot security policy, SSV and acquisition strategy.
Read guide
Artifact cheat sheets
Where each artifact lives, what it proves, its timestamps and the tools to parse it.
- APFS Timestamps and Local Snapshots on macOSAPFS nanosecond file timestamps, directory Date Added and local Time Machine snapshots: the base layer for macOS file timelines and recovery.
- Time Machine Backups: macOS Configuration and HistoryTime Machine settings, destinations and backup sets on HFS+ and APFS disks: a source of older file versions and proof of when backups ran.
- Unified Logs: macOS tracev3 System LoggingmacOS Unified Logs (tracev3 plus uuidtext) record logins, sudo, TCC, Gatekeeper, installs and device activity with sub-second timestamps.
- macOS Keychain Files: Metadata for ForensicsmacOS keychains store credentials, keys and certificates; their metadata shows which accounts, services and certificates existed and when items changed.
- dslocal User Accounts: macOS Local Users and Groupsdslocal plists define every local macOS account and group, with creation, password-change and failed-login times that expose rogue or hidden accounts.
- iPhone Backups and Pairing Records on a MacFinder (MobileSync) backups of iPhones and iPads on a Mac, plus lockdown pairing records, show which iOS devices were connected, trusted and backed up.
- Mounted Disk Images on macOS: DMG, ISO and App TranslocationHow to prove a DMG or ISO was downloaded, mounted and used on a Mac: quarantine, Unified Logs, FSEvents, App Translocation paths and Spotlight.