Chapter 7 - OS X El Capitan forensics

Abstract

Apple’s OS X has a steady growth within the United States. This also means digital forensics laboratories will likely see more OS X products. This chapter looks at Mac OS X 10.11 El Capitan. The chapter begins at the top level or root directory, and it works down the file system. This chapter highlight areas of forensic interest. However, it also takes a basic look at the file system as a whole. This chapter gives the analyst a foundation in OS X. There is also a quick guide at the back of the chapter providing paths to key forensic information.