
With the recent and growing rise of Apple's market share and Microsoft's graceful decline forensic investigations will increasingly encounter Macs as part of the case. But does your existing toolset and methodologies take HFS+ unique characteristics into consideration? What about filevault and timemachine related structures.
Check out the Mac OSX Forensics
site as a good place to start with the learning.
Comments