Mac OS Free First Responder Tools

There are a few; notably FTK Imager for Mac, Disk Arbitrator and the Blackbag tools. Have listed some here http//forensiccontrol.com/resources/free-software/ Would like to include more in this list, so if anyone has any further suggestions I'm all ears!

This book has a section on the matter. I used it as a starting point to write an Applescript that runs my own trusted tools.

http//www.amazon.com/gp/product/1597492973?ie=UTF8&tag=maosxfo-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=1597492973

For on scene use there are some command lines to use, but this can be a task setting up. Also Sumuri's Paladin and Forward Discovery's Raptor Bootdiscs. There is also ATC NY's MacMarshal Field Edition (sorry not free). Be sure to check out www.appleexaminer.com for more information on tools and techniques that are out there. Some of the main things to look for first responders aside from the normal date/time, applications, is File Vault (User home folder encryption) and now with Mac OS X Lion full disk encryption.

Regards,

Chris Currier