Page 1

MACOSSYSTEMARTEFACTS · A GUIDE FOR UK LAWYERS macOS System Artefacts Unified Logs, Activity Databases and the Detailed Record of What Was Done, and When COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 19 with limits such as log rotation stated plainly. ACTIVIT Y TIMELINE RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the Mac remembers what was done 03 The principal system artefacts 04 What each artefact reliably shows 05 Building the activity timeline 06 Interpretation, log rotation and honest limits 07 Deployment: proving activity, use and presence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary and many other artefacts, that reconstructs what applications ran, what files were opened, what was searched and when the user was active, answer in g the who-did-what-when questions at the heart of disputes, provided each artefact is interpreted for what it truly shows.

§ 02 · FIRST PRINCIPLES The problem in plain English: the Mac remembers what was done

§ 03 · THEARTEFACTS The principal system artefacts UNIFIED LOGS ACTIVITY DB SPOTLIGHT RECENT ITEMS QUICK LOOK / FSEVENTS