Guide
Gatekeeper XProtect And MacOS Malware Artefacts
17 pages · 27 min read
Macs are susceptible to malware, and Apple's built-in security features, Gatekeeper and XProtect, record activity.
- Apple and macOS forensics
- Cyber incidents and ransomware
§ Guide topic
Cyber incidents and ransomware
3 practical guides on cyber incidents and ransomware for UK litigators, in-house counsel and investigators. Read every page online or download the PDF, free and without registration.
Ref · E-D · 2026 · §TPCClass · ConfidentialJuris · England & WalesStatus · Active
3 practical guides on cyber incidents and ransomware, written for UK litigators, in-house counsel and investigators handling disclosure and digital evidence, and every guide can be read in full on its own page or downloaded as a PDF, free and without registration.
§ Questions visitors ask about cyber incidents and ransomware
§ 3 guides on cyber incidents and ransomware
Ask The Library about Cyber incidents and ransomwareGuide
Android Malware Stalkerware And Compromise
20 pages · 27 min read
Android's openness creates a larger threat surface, making sideloaded stalkerware and malware easier to install.
- Mobile and messaging evidence
- Cyber incidents and ransomware
Guide
Preserving Evidence After A Cyber Attack Or Ransomware Incident
17 pages · 22 min read
Understanding how to preserve evidence after a cyber attack or ransomware incident is crucial for UK litigators, in-house counsel, and investigators.
- Preservation and legal holds
- Cyber incidents and ransomware
§ Other topics
- Mobile and messaging evidence (24)
- Forensic collection and imaging (22)
- Electronic disclosure practice (19)
- Apple and macOS forensics (14)
- Deleted data and recovery (13)
- Chain of custody and defensibility (10)
- Cloud evidence (10)
- Expert evidence and reports (8)
- Servers, NAS and virtual environments (8)
- Metadata and timestamps (7)
- Open source, web and log evidence (7)
- Custodians and data mapping (6)
- Encryption and access (6)
- Data theft and exfiltration (5)
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.