looking for MacBook...
 
Notifications
Clear all

looking for MacBook with T2 chip " cheat sheet" poster

4 Posts
3 Users
0 Likes
1,764 Views
(@silentell)
Posts: 5
Active Member
Topic starter
 

Hi all

 

I have a MacBook with T2 chip and I have managed to forensically image it with blacklight Macquisition, after extracting the image file, I am able to run with it belkasoft for further investigation,

however, now I am wondering and looking for a cheat sheet that can help me with the investigation of this case,

I have looked online and I found nothing yet, and I thought to add a post here and hope to get something back!

So my question, is there a cheat sheet poster to use to help out with investigation and recover potential artefacts?

 

Many thanks

Silenthell

 
Posted : 25/08/2020 12:37 pm
(@jadams951)
Posts: 37
Eminent Member
 

Just saw this.  Not sure it'll help but worth a shot.  

 

https://www.cellebrite.com/en/whitepapers/apple-computer-and-macos-basics/

 
Posted : 26/08/2020 2:36 am
(@silentell)
Posts: 5
Active Member
Topic starter
 

Hi

 

Jadam951, thank you for your reply, I have looked into this paper and it's a basics technical guide report, its not what I'm looking for.

 

Im looking for a cheat sheet or a poster that same as the SANS windows artefacts locations poster but for a MacOS Mojave version. 

 

many thanks

 
Posted : 27/08/2020 11:46 am
(@mister4n6)
Posts: 12
Active Member
 

Hi - have a look at the google sheet, paying attention to the tabs down the bottom from here, https://github.com/pstirparo/mac4n6.

This post was modified 3 years ago by Mister4n6
 
Posted : 27/09/2020 11:16 pm
Share: