MacOS Screen Lock a...
 
Notifications
Clear all

MacOS Screen Lock and Unlock times

vrocco
(@vrocco)
Junior Member

I am not very adept with Mac forensics at all, but I have an image of a iMac and I need to determine when the screen was locked or unlocked. Can anyone point me in the right direction? I am using EnCase and I looked for an EnScript, but didn't find any that were close to what I needed. 

Where are these artifacts stored? Anything I need to know about parsing the files? I have the image loaded into EnCase and I can see the file system.

Thank you in advance.

Quote
Topic starter Posted : 06/05/2021 8:44 pm
Share: