Macs are more common than ever and frequently the target of forensic investigation. Do you know what happens when a mac boots? What gets erased and how to retrieve it? Do you know the limitations of mac tools? Explore the world of OS X forensics and some general practitioner observations with Brian highlighting some useful books, tools, websites, and his own material used in mac forensics.

Brian Martin, CISSP, HCISSP, CHFI, BS, CHS3 is an entrepreneur and owner of Liticode in Allentown, PA. He is a computer security expert and electronic evidence specialist with 30 years of business and technology experience. Liticode assists clients and legal agencies with electronic evidence, digital forensics, and security consulting.

Recorded at AIDE 2017