Page 1

MACFORENSICS · A GUIDE FOR UK LAWYERS Mac Evidence in Litigation APFS, File Vault, Time Machine, iCloud and the Artefacts of macOS COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM COURT-EXPERIENCED EXPERT WITNESSES

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac is not a Windows machine in nicer clothes 03 Acquisition: File Vault, Apple Silicon and getting the data at all 04 APFS: snapshots, clones and what deletion means now 05 The macOS artefact map: what the system records 06 Time Machine: the versioned past 07 iCloud: the half of the Mac that lives else where 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: RICHEVIDENCE, DIFFERENTRULES

§ 02 · FIRST PRINCIPLES The problem in plain English: the Mac is not a Windows machine in nicer clothes

§ 03 · THEFRONTDOOR Acquisition: File Vault, Apple Silicon and getting the data at all