How do you go back in time to review what happened on an APFS volume? In Apple’s latest file system, snapshots are now used to store the history of changes to files. In addition, the file system may be creating this back up data in snapshots whether the user knows it or not.
In this webinar, BlackBag’s Dr. Joe Sylve will discuss:
– Details of the snapshot functionality built into APFS
– Why snapshots will be useful in your investigations
– How you will be able to take advantage of them in the upcoming BlackLight release
– If your tool of choice is not parsing APFS snapshots, then you may be missing data.
Presenter: Dr. Joe T. Sylve, Director of Research and Development, BlackBag Technologies
Date / Time: Wednesday, July 11th 2:00pm EDT / 7:00pm BST / 11:00am PDT
