I have taken an image of the Macbook's hard drive with the help of advices found here (T mode) and now I'm just gonna analyse the content.
Can anyone suggest which folders od Macbook are forensic important?
Thanx a lot )
Ricco,
Have you looked at
Regards,
Chris Currier
Ditto what Chris said. Just start going through that site and http//insidethecore.com/ for the Plist of the week. Then it will start to unfold as to where else to look.
Recent thread around this as well
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&p=6551743
Great thanx for suggestions guys )
Another that may be helpful to you
http//
Some of the earlier Mac Forensic documents are there as well, but look at the comparison between the Windows Registry and the associated Mac plist.
Regards,
Chris
Thanx Chris for this link