Guys an Gals,
I have an image of a macbook 13 I took last week whilst on site, it had a 160GB hdd, the case involves me having to look for specific user access between a set period of time, and if so what was done during that specific time period, the time line suggests not a great deal of files were changed within that time, but I want to make sure I get as much info out as possible.
What should I look at - new to mac's to be honest, I've pulled the VAR logs, and am currently examining them… time lining again suggests not a great deal within the time frames.
The time frame in question is from the last quarter of last year (approx two weeks)
any help appreciated. ) links or guidance… )
Another question, anyone have any ideas if there's any where that stores the password created date for a user account???
Since this is a month old, I am hoping you got your question answered. But you should get the Mac OSX forensic book that is out. http//