System time changed on Apple Mac
I need some advice please. In the Windows OS, when someone changed the system date/time, places to get evidence are from Events files, “Setupapi.log” file, restore point folder creation dates, Virus scan logs etc.
Can anyone put me on the right track to get any evidence when someone changes the system date/time on an Apple Mac OS.
Thanks for the time.
Computer Forensics NZ Ltd
Phone +64 9 35 99 424