I have come accross 3 macs in a current investigation. Although Encase allows viewing of the structure etc, I can only view the databases (messages etc) in hex/ text format.
The databases appear to contain significant evidence in this case.
So far I've been unsuccessful in getting a cloned drive to work in the mac machines.
Is there anyone who has examined macs before who can direct me on what programs I can use to view these files?
Machine uses OS 9
many thanks
Hello,
The digital detective forum has a few people that are very very good with MAC's
Register over there and I'll bet you will get a quick response.
http//
These guys also know a ton of information.
http//
thanks. Still waiting to register with blackbagtech though. Still open to any suggestions to view these in the mean time.