Hi all
I have a MacBook with T2 chip and I have managed to forensically image it with blacklight Macquisition, after extracting the image file, I am able to run with it belkasoft for further investigation,
however, now I am wondering and looking for a cheat sheet that can help me with the investigation of this case,
I have looked online and I found nothing yet, and I thought to add a post here and hope to get something back!
So my question, is there a cheat sheet poster to use to help out with investigation and recover potential artefacts?
Many thanks
Silenthell
Just saw this. Not sure it'll help but worth a shot.
https://www.cellebrite.com/en/whitepapers/apple-computer-and-macos-basics/
Hi
Jadam951, thank you for your reply, I have looked into this paper and it's a basics technical guide report, its not what I'm looking for.
Im looking for a cheat sheet or a poster that same as the SANS windows artefacts locations poster but for a MacOS Mojave version.
many thanks
Hi - have a look at the google sheet, paying attention to the tabs down the bottom from here, https://github.com/pstirparo/mac4n6.