Hi all
Â
I have a MacBook with T2 chip and I have managed to forensically image it with blacklight Macquisition, after extracting the image file, I am able to run with it belkasoft for further investigation,
however, now I am wondering and looking for a cheat sheet that can help me with the investigation of this case,
I have looked online and I found nothing yet, and I thought to add a post here and hope to get something back!
So my question, is there a cheat sheet poster to use to help out with investigation and recover potential artefacts?
Â
Many thanks
Silenthell
Just saw this. Not sure it'll help but worth a shot. Â
Â
https://www.cellebrite.com/en/whitepapers/apple-computer-and-macos-basics/
Hi
Â
Jadam951, thank you for your reply, I have looked into this paper and it's a basics technical guide report, its not what I'm looking for.
Â
Im looking for a cheat sheet or a poster that same as the SANS windows artefacts locations poster but for a MacOS Mojave version.Â
Â
many thanks
Hi - have a look at the google sheet, paying attention to the tabs down the bottom from here, https://github.com/pstirparo/mac4n6.