MacOS Screen Lock and Unlock times
I am not very adept with Mac forensics at all, but I have an image of a iMac and I need to determine when the screen was locked or unlocked. Can anyone point me in the right direction? I am using EnCase and I looked for an EnScript, but didn't find any that were close to what I needed.
Where are these artifacts stored? Anything I need to know about parsing the files? I have the image loaded into EnCase and I can see the file system.
Thank you in advance.