MacOS Screen Lock a...
 
Notifications
Clear all

MacOS Screen Lock and Unlock times

1 Posts
1 Users
0 Likes
1,267 Views
vrocco
(@vrocco)
Posts: 33
Eminent Member
Topic starter
 

I am not very adept with Mac forensics at all, but I have an image of a iMac and I need to determine when the screen was locked or unlocked. Can anyone point me in the right direction? I am using EnCase and I looked for an EnScript, but didn't find any that were close to what I needed. 

Where are these artifacts stored? Anything I need to know about parsing the files? I have the image loaded into EnCase and I can see the file system.

Thank you in advance.

 
Posted : 06/05/2021 8:44 pm
Share:
Share to...