Apple Examiner RSS Feed

Reflector for OS X and Windows

Fri, 24 May 2013 16:13:42 -0400

We have written an article on using Reflector for iOS based casework. This application allows an analyst to take advantage of AirPlay and display native views of iOS data.

Cellebrite UFED Physical/Logical Analyzer 3.7 released

Thu, 16 May 2013 11:47:59 -0400

Cellebrite has just released the latest version of the UFED Physical/Logical Analyzer which includes specific features for iOS devices. Included are enhanced decoding for iOS devices and deleted apps list recovery. See their website for full details. We have a direct link from our website.

File System Comparison article and reference

Wed, 01 May 2013 20:04:06 -0400

We have posted a quick reference to OS X and its abilities to utilize other file systems. This reference also correlates date stamps from HFS+ to other file systems.

BlackLight 2013R1.1 released

Tue, 30 Apr 2013 11:55:09 -0400

BlackBag Technologies has released an update to BlackLight, bringing fixes and new features to the OS X, iOS and Windows analysis application. Full details of this update can be found on their website. We have a direct link from our website.

Audit from TwoCanoes

Thu, 25 Apr 2013 11:57:41 -0400

Audit is open source software to control and read the audit logs of an OS X system. The audit logs contain information such as login/logout, authentication, and administrative actions. We have a direct link from our site.

MacQuistition 2013R1.1 released from BlackBag Technologies

Wed, 10 Apr 2013 12:53:10 +0200

BlackBag Technologies has released an update to their Mac Incident Response and Imaging tool. This update adds new features and enhances support for all of the latest Macs. See the BlackBag website for complete details. We have a direct link from our site.

Internet Evidence Finder (IEF) v6 released with new OS X artifact support

Wed, 27 Mar 2013 15:55:54 -0400

IEF v6 has been released today with new support for OS X artifacts. IEF v6 includes support for images and virtual machines with HFS+ and HFSX file systems. Notable features include parsing of many social network artifacts, peer to peer artifacts, unique Mac data with iChat, Adium and Amule, Time Machine, sleepimage file parsing and unencrypted swap file parsing. Details can be found at Magnet Forensics website and we have a direct link from our site.

Lion Disk Maker, for creating 10.7 and later bootable media

Tue, 30 Apr 2013 11:55:31 -0400

This website has a great free Applescript based app to create bootable install media for 10.7 and later. The bootable media is great for system rescue, as well as the included utilities such as ‘passwordreset’.

BlackLight 2013R1 released from BlackBag Technologies

Wed, 20 Mar 2013 09:51:33 -0400

BlackBag Technologies has released BlackLight v2013R1 with many notable new features. Included is support for NTFS and Windows analysis meaning, no external tools needed when BootCamp is utilized. Also new, Timeline analysis based on all or selected items in the case. Also updated is the internet artifact analysis and filters throughout the case. See the BlackLight page for full details. We have a direct link from our site.

Build the Ultimate Mac based imaging and triage workstation

Wed, 06 Mar 2013 12:58:52 -0500

In this article, we offer rationale for using Macs for evidence imaging and triage. Hardware and software is explored as well as a few common situations where this can be used. We build both a field and laboratory, low-cost, solution to image, view, and work with all types of evidence.

Reflector for OS X

Thu, 28 Feb 2013 11:41:18 -0500

Reflector is an application that allows an iOS device to AirPlay to the Mac screen. Many times, a native picture of data can mean more during a case than just the data itself. This application will show a simulated iOS device (even in white or black) along with the screen of the iOS device you choose to display. Simple screen captures of this can easily be added to a report. We have a direct link from our site.

Safari, Top Sites & Webpage Previews

Tue, 19 Feb 2013 15:56:32 -0500

We have written an article on the current feature in Safari called “Top Sites”. This feature creates PNG files as a part of this function. The pictures can be used as a part of the digital forensic story of a Mac. This article contains the “header” for webpage preview files to assist in your file carving.

MacQuisition 2013.R1 released from BlackBag Technologies

Tue, 19 Feb 2013 07:44:20 -0500

The latest version of MacQuisition, the Incident Response and Imaging tool based on OS X has been released from BlackBag. This version brings GUI compatibility to all of the latest Macs as well as new features for live Mac collections.

Paladin 4 has been released.

Tue, 19 Feb 2013 07:40:47 -0500

2 weeks ago, we announced the pre-release of Paladin 4..Sumuri LLC has released the final version of Paladin 4..We have a direct link from our site.

Quick Look, add more functionality to your analysis Mac

Mon, 04 Feb 2013 14:25:26 -0500

OS X Daily has a great blog post on installing the QLStephen Quick Look plug-in. It allows for text files to be viewed, regardless of the extension, or lack thereof. We have a direct link from our website.

AccessData releases updates to FTK and MPE+ with additional Apple support

Thu, 31 Jan 2013 08:24:19 -0500

Forensic Toolkit has been updated to include native support for Apple iWork ’09 file types. MPE+ has been updated with additional support for iOS 6. We have a direct link from our site.

USB Entries and Automated Perl Script

Mon, 28 Jan 2013 08:19:10 -0500

Jason Hale has written a Perl Script that automates the process of collecting relevant log file entries for USB device connection to OS X. We have a direct link to his blog from our site.

Paladin 4.0 from Sumuri to be released

Thu, 17 Jan 2013 21:59:12 -0500

Sumuri LLC will be releasing their latest version of Paladin this week, and announcing first thru AppleExaminer.com. The new version is huge upgrade offering re-written code and the following notable features: new XFCE environment, live progress log viewer, support for (Ex01, SMART, AFF, VMDK, EXT4 and ExFAT) file format and systems, new image converter, new disk manager, image mounter, and inclusion of many of the popular open-source forensic tools. The complete set of release notes and details can be found at the Sumuri website. We have a direct link from our site.

Acquisition methods has been updated.

Thu, 10 Jan 2013 12:47:48 -0500

Our Mac acquisition page has been updated to discuss Thunderbolt, current Firmware Password methods, and other solutions.

AppleExaminer.com news!

Tue, 04 Dec 2012 09:57:57 -0500

I have changed employers and I pleased to share the news with you. Please visit AppleExaminer.com for thank you to all readers.

AccessData PRTK and FileVault2

Tue, 04 Dec 2012 09:56:51 -0500

The latest version of Password Recovery Toolkit from AccessData supports attacking and decrypting OS X 10.7 and later FileVault 2. We have a direct link from our site.

DaveGrohl 2, OS X password cracking tool

Tue, 04 Dec 2012 09:56:22 -0500

DaveGrohl is a tool to assist in password cracking on OS X. The current version allows for distributed attacks and supports a variety of hash types. We have a direct link from our site.

BlackLight 2012.R4 released with significant new features

Thu, 01 Nov 2012 10:41:27 -0400

BlackBag Technologies has released a significant new version of their Apple data analysis tool, BlackLight. New features include Skype analysis, side-by-side analysis, integrated filters and searches, virtual machine support Time Machine support, secure USB keys and iOS 6/OS X 10.8.2 support. We have a direct link from our site.

OS X Clipboard Managers and digital artifacts

Mon, 29 Oct 2012 08:47:57 -0400

Eli Rosenblatt has written an article detailing artifacts from OS X clipboard managers.

HFS/HFS+ and Linux

Fri, 19 Oct 2012 12:41:05 -0400

John Lehr has written an excellent article regarding Linux and Mac image files. His article discusses the usage of specific tools to mount and read the HFS and HFS+ file systems on early and new Linux kernel systems. We have a direct link from our site.

AccessData MPE+ version 5 released

Thu, 06 Sep 2012 08:31:36 -0400

AccessData has released version 5 of MPE+ for cell phone, smart phone and tablet analysis. This release enhances many of the analysis capabilities including visualization for time-lining. We have a direct link from our site.

MemMarshal from ATC-NY released

Thu, 06 Sep 2012 08:31:00 -0400

ATC-NY has released a free OS X memory analysis tool. MemMarshal offers a user-friendly, automated memory analysis system for volatile memory (RAM) images. We have a direct link from our site.

VMWare Fusion v5 and digital forensics

Thu, 30 Aug 2012 09:24:14 -0400

We have posted an article on how to use the new VMWare Fusion v5 with more than 8GB of RAM. This article shows FTK v4 running successfully in a virtualized environment.

OS X Folder Layout (Part 4)

Mon, 27 Aug 2012 14:43:59 -0400

n part 4, we look at the directories that are well hidden from view and their meanings. BlackLight and fileXray are used to reveal content.

Paladin 3.0 released by Sumuri LLC

Mon, 27 Aug 2012 14:42:32 -0400

Sumuri LLC has released the latest version of Paladin. Included is boot support for newer models Macs. We have a direct link on our site.

iOS Pairing File Locations

Thu, 19 Jul 2012 07:40:07 -0400

We have added a page listing the location of iOS paring files for each operating system.

Mac Memory Reader v3.0.2 released

Wed, 18 Jul 2012 19:53:58 -0400

ATC-NY has released their free tool for OS X memory capture. This release adds support for OS X 10.8 Mountain Lion. We have a direct link from our site.

OS X Folder Layout (Part 3)

Wed, 11 Jul 2012 09:07:15 -0400

In part 3, we look at the entries in the User Home folder of a standard 10.7 Lion installation, as well as a few non-standard yet popular artifacts.

FileVault 2 white paper and open source code available

Fri, 06 Jul 2012 11:44:26 -0400

Omar Choudary, Felix Grobert and Joachim Metz have written an excellent white paper regarding FileVault 2. They have also released code to mount FileVault 2 volumes. We have direct links from our site.

BlackLight 2012 R2 released

Fri, 29 Jun 2012 07:26:06 -0400

BlackBag Technologies has released BlackLight 2012 R2 for OS X and iOS analysis on Mac and Windows platforms. This latest release includes automated iOS backup folder recovery, graphics-based analytics, custom templates, video frame analysis, network licensing and complimentary on-line training. We have a direct link from our site.

Mandiant Mac Memoryze

Mon, 25 Jun 2012 14:43:43 -0400

Mandiant Mac Memoryze is available as a free download. This tool is used to acquire and analyze OS X RAM. The tool supports OS X 10.6 and 10.7. We have a direct link from our site.

OS X Folder Layout (Part 2)

Mon, 25 Jun 2012 14:16:51 -0400

In part 2, we look at several locations available from the Root level that are likely hidden from GUI view of the user yet contain a wealth of information for any analysis. Part 3 will look into the User's Home folder and Part 4 will discuss locations not seen from either the GUI or Terminal.

OS X Folder Layout (Part 1)

Mon, 11 Jun 2012 21:16:52 -0400

In part 1 of this series, we begin to examine the file and folder structure of the OS X 10.7 installation. We look at the structure from the Finder (GUI), and the Terminal (Command Line). Later we look into the User’s Home folder and finally conclude the series with a view from analysis software showing data not seen from the Finder or Terminal.

Elcomsoft Phone Password Breaker and iCloud usage

Mon, 11 Jun 2012 21:15:17 -0400

In this article, we examine the new feature of Elcomsoft’s latest edition of Phone Password Breaker and download an iOS device backup from Apple iCloud storage, and further analyze the content.

Elcomsoft iOS Forensic Toolkit v1.15 released

Wed, 06 Jun 2012 12:50:23 -0400

Elcomsoft iOS Forensic Toolkit has been updated to v1.15. Support for the new iPad (iPad 3) has been added along with optimization for the pass code recovery of 4 digit pin locks. We have a direct link from our site.

Synalyze It! and Synalyze It! Pro

Fri, 01 Jun 2012 11:24:41 -0400

Synalyze It! is an OS X binary file analyzer. Features include Hex Editor & Viewer, Printing, Histogram, “Go To”, Searching, and Grammar. Synalyze It! also features color coding of data and customizing of views. The application is available thru the Mac App Store as Synalyze It! and Pro.

Elcomsoft Phone Password Breaker updated with iCloud support

Tue, 15 May 2012 10:14:27 -0400

Elcomsoft has updated EPPB to include iCloud functionality. The tool now has the ability to retrieve iPhone user data from the iCloud without any lengthy attack or physical access to the device. The data is directly downloaded to the analyst’s computer. We have a direct link from our site.

“An Evaluation of Windows-Based Computer Forensics Application Software Running on Macintosh” by Gregory H Carlton

Tue, 15 May 2012 10:13:40 -0400

Gregory H.Carlton has written a white paper initially distributed by the Journal of Digital Forensics, Security and Law discussing the value of the Apple Macintosh running the Windows operating system. We have a PDF version directly available from our site.

Congratulations to Sarah Edwards and SANS

Fri, 11 May 2012 09:48:36 -0400

Congratulations to SANS for selecting Sarah Edwards as their new lead writer for their next Macintosh Forensics class. Sarah will be a spectacular addition to the SANS team and we look forward to seeing her new class material. Good luck to you Sarah!

MacResponse LE released

Thu, 10 May 2012 22:37:10 -0400

MacResponse LE is designed to provide law enforcement with critical capabilities needed to reliably collect and analyze data from live computer systems running various versions of Mac OS X. MacResponse LE™ was developed by AIS, Inc. through a National Institute of Justice (NIJ) Electronic Crime grant and is available for free. For additional information, we have a direct link from our site.

iOS Forensic Toolkit v1.14 available from Elcomsoft

Wed, 18 Apr 2012 19:41:41 -0400

Elcomsoft’s iOS Forensic is available from Elcomsoft. This release has the latest support for physical and logical imaging of iOS devices. We have a direct link from our site.

Oxygen Forensic Suite 2012 released

Wed, 18 Apr 2012 19:41:06 -0400

Oxygen Forensic Suite 2012 has been released adding new capabilities for iOS device acquisition and analysis. A full list of features is available at their website. We have a direct link from our site.

MacLockPick v3 released from Subrosasoft

Wed, 11 Apr 2012 13:33:39 -0400

Subrosasoft Inc. has announced the availability of MacLockPick 3. MackLockPick 3 continues to be cross-platform supporting OS X, Windows and Linux operating systems. We have a direct link from our site.

"How to Use iOS 5 Devices in Litigation", Law Technology News

Tue, 10 Apr 2012 21:07:55 -0400

A well written article in the Law Technology News discusses how iOS devices are creating new avenues for counsel to prepare and present “digital paperwork”. We have a direct link from our site.

BlackBag Technologies announces new east coast offices

Tue, 10 Apr 2012 21:07:14 -0400

BlackBag Technologies has announced the opening of a new, state of the art, training and digital forensics facility in Herndon, VA. BlackBag Technologies is expanding their reach to law enforcement and private sector customers with their new training facilities and online classroom capabilities. We have a direct link to the press release on our site.

BlackLight 2012 R1 released from BlackBag Technologies

Wed, 21 Mar 2012 21:35:02 -0400

BlackBag Technologies has released BlackLight 2012 R1 with significant new features. The new release has added Metadata File Filtering, L01 image support, Enhanced Evidentiary Data Export, Custom Hash Set Creation and Multiple Hash Set Data Processing, as well as Positive and Negative Hash Value File Filtering. We have a direct link from our site.

Raptor 2.5 from Forward Discovery released

Mon, 12 Mar 2012 19:25:06 -0400

Forward Discovery has released their latest version of Raptor, their Linux boot CD. Notable with this release is compatibility with the latest Macbook Pro and Macbook Air models for imaging. We have a direct link from our site.

"Online Storage Thoughts" by John Mallery of Mallery Technical Training and Consulting

Sun, 11 Mar 2012 18:26:36 -0400

John Mallery of Mallery Technical Training and Consulting has posted a blog article that shows the network usage when online storage is in use with OS X or a Windows based PC. We have a direct link from our site.

DEVONtechnologies releases EasyFind v4.8.2, an update to their free application.

Mon, 05 Mar 2012 19:37:48 -0500

DEVONtechnologies has released an update to their free application EasyFind which allows for fast searching of full drives or mounted images in areas that SpotLight does not index. Options include boolean operators, wildcards, and drag&drop support. We have a direct link from our site.

Cellebrite UFED version 1.1.9.3 released

Tue, 21 Feb 2012 21:17:13 -0500

Cellebrite has released UFED version 1.1.9.3 which brings with it support for iMessage extraction from iOS devices running iOS 5. See the Cellebrite website for full release details. We have a direct link from our site.

HashCat - Advanced Password Recovery software

Sat, 18 Feb 2012 20:16:33 -0500

We have added a link in our Mac Software Section under "Decryption" to HashCat. HashCat is advanced password recovery decryption software that uses the CPU and GPU capabilities of a Mac or PC to crack hashes.

Demystifying iPhone Forensics on iOS 5 by Satish Bommisetty

Sun, 12 Feb 2012 21:06:48 -0500

Satish Bommisetty has written an excellent article about the analysis of the iOS backup files and direct analysis of the iOS devices. We have a direct link on our site.

iOS 5 iDevice Open Source Imaging using Lantern Lite

Fri, 03 Feb 2012 11:06:06 -0500

Sean Cavanaugh has written an in-depth article on the usage of the free, GUI based, iOS imaging utility Lantern Lite from Katana Forensics.

Elcomsoft iOS Forensic Toolkit 1.12 released

Sat, 28 Jan 2012 14:05:39 -0500

Elcomsoft has released iOS Forensic Toolkit version 1.12 adding support for the iPad2 and iPhone 4S. Elcomsoft now supports all generations of iOS devices. See their website for full details of coverage. We have a direct link from our site.

MacQuisition 2012.1 from BlackBag Technologies released

Thu, 26 Jan 2012 11:07:12 -0500

MacQuisition 2012.1 has been released with significant new features expanding this utility well beyond imaging of Macs. Included is targeted acquisition, live data acquisition, acquisition and hash monitoring, ThunderBolt support, and OS X 10.7 support. We have a direct link from our site.

MacForensicsLab v4.0 released

Thu, 19 Jan 2012 11:43:04 -0500

SubRosaSoft's MacForensicsLab 4.0 is a suite of forensics and analysis tools for Mac, Linux, and Windows storage devices. It provides device imaging, in-depth catalogs, keyword searching and analysis block by block, file salvage, disk arbitration management, and drive cleaning. This release has been rewritten "to take full advantage of the power of Mac OS X" and adds redesigned navigation for the main window, a new search interface and functions, improved bookmark management, and improvements for the user-selectable auditing function. MacForensicsLab is $1,495 ($495 upgrade) for Mac OS X 10.4 and up (Universal Binary on dual-boot CD). We have a direct link from our site.

"iPhone Forensics" by Satish Bommisetty

Thu, 12 Jan 2012 20:44:16 -0500

An article about recovery of iOS 5 artifacts on a live iPhone has been posted by author Satish Bommisetty using open-source tools released from Sogeti Labs. We have a direct link on our site.

Cellebrite UFED 1.1.9.0 released with addition iOS support

Thu, 12 Jan 2012 20:41:46 -0500

Cellebrite UFED 1.1.9.0 has been released with enhanced supported for iOS. It now offers real-time keychain decryption revealing user passwords and iOS 5.1 beta 2 logical and file system extraction via the UFED. We have a direct link from our site.

ATC-NY has announced free training for Mac Marshal

Mon, 09 Jan 2012 19:25:26 -0500

ATC-NY has announced free training for Mac Marshal, their free triage tool that is OS X and Windows based. Mac Marshal gives analysts a very clear insight into the Apple Environment being triaged including internet artifacts, virtual machines, Boot Camp info, eMail, and more. We have a direct link from our site.

BlackLight R5 from BlackBag Technologies released

Sun, 01 Jan 2012 13:22:58 -0500

BlackBag Technologies has released BlackLight R5 of their OS X and Windows based digital forensics application suite. This release brings along enhancements and fixes to the previous version. Notably, decoding of user(s) login password, optimized picture processing and metadata tagging, reporting enhancements, importing of third party data and optimizations for both operating systems. We have a direct link from our site.

Hex Fiend by ridiculous_fish

Sun, 01 Jan 2012 13:22:16 -0500

Hex Fiend by ridiculous_fish is an open source hex editor that has an excellent GUI, is very fast to use, and likely will help in your digital forensics. We have a direct link from our site.

Emailchemy 11.2 released from WeirdKid Software

Mon, 19 Dec 2011 09:52:19 -0500

WeirdKid Software has released an update to the very popular Emailchemy email conversion tool. This update includes enhancements for AOL, Entourage and Claris Emailer among many others. We have a direct link from our site.

SoftBlock from BlackBag Technologies updated for Lion

Thu, 15 Dec 2011 13:29:07 -0500

SoftBlock, the software kernel extension to assist in imaging and previewing evidence in a read-only, write-blocked manner has been updated by BlackBag Technologies for OS X 10.7 Lion. We have a direct link on our site.

Disk Images and the Apple virtual disk

Sun, 04 Dec 2011 22:15:54 -0500

We have written an article on the Apple virtual disk format, DMG, and how to convert between compressed and uncompressed when needed.

Cellebrite UFED v1.1.8.6 released adding more iOS features

Wed, 30 Nov 2011 19:47:36 -0500

Cellebrite has released UFED v1.1.8.6 with new functionality for iOS devices. New functions include physical and file system extractions for iOS 5 and 5.0.1 devices, real-time decryption, passcode recovery and iPhone 4S support. We have a direct link from our site.

PDF Files and PDFPen Pro to edit and create great case reports

Sun, 27 Nov 2011 20:26:34 -0500

We have written an article about case reports and specifically the PDF format. We use the application PDFPen Pro to look at embedded data, redact data, and edit the PDF files to create great looking reports at case completion.

Mac Marshal 3.0 released from ATC-NY

Mon, 21 Nov 2011 11:15:40 -0500

ATC-NY has released the latest version of Mac Marshal. Notable in this release is Lion compatibility, analysis of iCloud configs, bluetooth history, and a new Windows version. We have a direct link on our site.

Mac Memory Reader updated by ATC-NY

Mon, 21 Nov 2011 11:15:09 -0500

ATC-NY has updated the free Mac Memory Reader to include a new option to dump “reserved” regions of RAM such as shared video RAM. We have a direct link on our website.

From Homeric Writings to Cellphone Forensics, Some Favorite Online Resources

Sun, 13 Nov 2011 22:00:17 -0500

The Chronicle asked professors what Web resources they've found most useful in teaching and research. Here are excerpts from some of their answers.

SafariCacheView v1 from NirSoft released

Tue, 08 Nov 2011 19:56:13 -0500

SafariCacheView is a Windows based utility for reading the Safari cache. It has been released free to the community from NirSoft. It features reading and parsing the cache.db file as well as exporting selected items to several standard file formats. We have a direct link from our site.

Paladin 2 released from Sumuri LLC

Mon, 07 Nov 2011 10:31:10 -0500

Sumuri LLC has released Paladin 2, their free Ubuntu based CD for Mac and PC imaging and limited analysis capabilities. See the Sumuri website for full release details.

Safari Cache Revisited by Sean Cavanaugh

Sun, 30 Oct 2011 15:02:00 -0400

Sean Cavanaugh has written an article exploring the latest in Safari caching and OS X 10.7 Lion. We have a link to this article on our website.

BlackLight R4 Announced from BlackBag Technologies

Wed, 19 Oct 2011 21:33:50 -0400

BlackBag Technologies has announced BlackLight R4 will be released on October 24. This release has major updates to searching, media processing, tagging, reporting, legal review and support. A Customer Briefing is scheduled for October 25th, 10am with registration at BBT’s website for free. We have links to each from our site.

BBT announces 2 "BBT-200" classes

Fri, 14 Oct 2011 10:20:23 -0400

BlackBag Technologies has announced 2 of their 200 levels classes to be held in January and February. See the BBT Training page for full details.

OS X 10.7 Lion Artifacts

Sun, 09 Oct 2011 09:14:28 -0400

Sean Cavanaugh has started a Google Docs spreadsheet that is community based, listing artifacts for the 10.7 Lion operating system. We have a link to this resource from our main page as well as the OS X - Analysis section of the site.

Advanced iOS Training announced for Cleveland

Sun, 09 Oct 2011 09:13:24 -0400

Jonathan Zdziarski has announced the latest in his series of iOS training classes. The next class is an “Imaging and Analysis L-1” class in Cleveland, OH. Details available at his site and we have provided a link from ours.

New Lead Contributor Joining AppleExaminer

Sun, 02 Oct 2011 22:24:47 -0400

Sean Cavanaugh has been contributing to the site in rapid-fire way lately. AppleExaminer is pleased to announce that he will be joining the team as a lead contributor to the site. Watch for more article from Sean in the future.

New Editor Joining the AppleExaminer Team

Sun, 02 Oct 2011 22:34:14 -0400

AppleExaminer would like to welcome Sarah Edwards as a new Lead Contributor and Editor of the site. Sarah is a well known writer and researcher on the OS X and iOS platforms. In the Reading Resources, you will find links to many of her articles available now from her blog. Look for new articles from her in the future here.

Apple Examiner Store and new embroidered items

Sat, 24 Sep 2011 15:14:34 -0400

Now is a great time to re-visit our Apple Examiner Store. Take a look at the new items LOFCE has added for embroidery with our logo. Show of your Apple side with more than just the Apple logo! Don't forget to use our Amazon Store when shopping as well. Thanks for you support in keeping the site successful.

iPhoto Trash Analysis by Sean Cavanaugh

Sat, 24 Sep 2011 15:11:45 -0400

Sean Cavanaugh has written an article showing how iPhoto maintains its own “Trash” separate from the operating system and how analysis can be accomplished to recover data.

Locating FileVault Sparse Bundles in Digital Forensics

Tue, 13 Sep 2011 11:14:58 -0700

Sean Cavanaugh & John Jackson have written an excellent article on locating multi-linked files in Time Machine Backups using a Windows based environment. We have added it to our Reading Resources.

Belkasoft Evidence Center released

Fri, 26 Aug 2011 14:57:04 -0400

Belkasoft has released Evidence Center, software that runs on Windows, but has capabilities of processing OS X data including Instant Messaging and Email from most popular clients, image and video analysis, and deleted history functionality. We have a direct link to their site.

Computer Forensic Examiner Quick Reference Guide by Lock and Code released

Wed, 24 Aug 2011 15:06:39 -0400

Lock and Code has released a great, free iOS App that contains a quick reference chart to Windows, FAT and NTFS facts. It also has a First Responders Guide. This release lacks OS X and HFS/HFS+ references so give them some great feedback! We have a direct link to their site on ours.

AccessData releases MPE+ 4.4

Mon, 15 Aug 2011 22:14:28 -0400

AccessData has released version 4.4 of their cell phone and smart phone analysis tool. Notable in this release is the decryption of locked iOS filesystems including iPhone4, iPad1 and iPod Touch 3/4 plus the Forensic SIM cloner. We have a direct link to their site.

F-Response TACTICAL & 10.7 Lion

Sat, 13 Aug 2011 23:28:15 -0400

F-Response TACTICAL & 10.7 Lion: we have added a new article about using F-Response TACTICAL for live response to Lion based Macintosh computers that have FileVault2 (full disk encryption) enabled.

Cellebrite UFED Physical Pro v2.2 released

Sat, 06 Aug 2011 09:33:36 -0400

Cellebrite has released v2.2 of their Physical Pro cell phone and smart phone analysis tool which notably addresses the latest iOS firmware and hardware encryption offering a full decrypted of iOS devices. Full information available on their website and we have a direct link from our website.

Passware v11 released with new Macintosh features

Fri, 05 Aug 2011 19:07:35 -0400

Passware has released v11 of their forensic tool that can break many password protected file and disk structures. Notable amongst this release is the Mac features for firmware acquisition of login password and Keychain stored passwords. See the full list of capabilities on their website with the direct link provided on our site.

BlackLight R3.2 released with full iTunes 10.4 compatibility

Fri, 05 Aug 2011 18:52:21 -0400

BlackBag Technologies has released BlackLight R3.2 which adds iTunes 10.4 full compatibility among all of the additions brought in with R3. A direct link is available on our site.

Elcomsoft iOS Forensic Toolkit 1.0.5 released, iOS 4.3.4 compatibility

Thu, 28 Jul 2011 19:36:19 -0400

Elcomsoft has released their latest in physical imaging software for iOS 4 devices to remain compatible with iOS 4.3.4. This version also added support for iOS 3.x, iPhone 3G/3GS and other features noted on their site and we have a direct link.

Mac Memory Reader 2.0.4 released from ATC-NY for Lion compatibility

Thu, 28 Jul 2011 19:22:07 -0400

ATC-NY has continued great work with their free RAM reading utility for the latest OS release from Apple, 10.7 Lion. We have a link from our site.

"Mounting split disk images under OSX", a blog entry on E01 image format

Tue, 19 Jul 2011 18:36:18 -0400

“Mounting split disk images under OSX” - a blog posting by Klein&Co that describes in detail how to install open source software to mount E01 to the Mac Desktop for analysis. We have a link to the posting from our site.

BlackLight R3 released from BlackBag Technologies

Mon, 18 Jul 2011 14:48:37 -0400

BlackBag Technologies has released R3 of their OS X and Windows based Apple examining software. It now offers support for E01 files, Elcomsoft images, Jonathan Zdziarski images, and more. We have a link to the BBT info page on our site.

Mobile Phone Examiner Plus (MPE+) 4.3.0 released

Mon, 18 Jul 2011 14:47:13 -0400

AccessData has updated its cell and smart phone analysis tool, MPE+ to version 4.3.0. Notably included is further support for the iOS devices.

iPhone and iOS Forensics by Andrew Hoog and Katie Strzempka

Wed, 22 Jun 2011 21:54:43 -0400

iPhone and iOS Forensics by Andrew Hoog and Katie Strzempka - Amazon has just emailed me a tentative shipping date of June 30th for this excellent resource and well written book for iOS digital forensics.

iOS Device Analysis Tools

Wed, 22 Jun 2011 21:17:51 -0400

iOS Device Analysis Tools - we have created a consolidated page with iOS device analysis tools available, classified by software, hardware and miscellaneous apps available.

Dropbox Reader from ATC-NY released

Wed, 22 Jun 2011 20:23:56 -0400

ATC-NY has released a free tool, Dropbox Reader, that “can acquire information about the registered Dropbox account, shared directories, and synchronized files.” See our site for a direct link to this and other free utilities from ATC-NY.

Elcomsoft Phone Password Breaker LE version article posted

Fri, 17 Jun 2011 14:03:10 -0400

we have posted an article on Elcomsoft’s latest Phone Password Breaker (LE edition) and how it can be used in obtaining an image of an iOS device with the latest firmware, even when pin-coded.

Emailchemy v11 released

Fri, 17 Jun 2011 07:22:48 -0400

Emailchemy v11 has been released. Among the notable features is converters for Outlook 2011 on Mac and .XML files along with Google Apps Uploader Tool. Emailchemy is an essential tool when dealing with email formats from platforms from new and old of all operating systems. We have posted a link to thier site from our main page.

“volafox” a.k.a “Memory Analyzer for Mac OS X” available

Tue, 14 Jun 2011 21:23:30 -0400

volafox is a python 2.5 application that will analyze images of Macintosh RAM. This utility is free and available from Google Code. We have posted a link on our website.

UPDATED SITE! We hope you enjoy our facelift...

Thu, 02 Jun 2011 21:08:44 -0400

UPDATED SITE! We hope you enjoy our facelift. This has been long overdue. Your feedback is the driving force behind the way this site runs. Thank you for your patience in the last month of behind the scenes changes.

BlackLight R2 released

Thu, 02 Jun 2011 21:08:10 -0400

BlackBag Technologies has released R2 of BlackLight. Amongst the big features is the application is now feature for feature exact on Windows and Mac for the same price. Also, the Mac version has Mobilyze incorporated into BlackLight. Read more about the large release here.

Mike's Forensic Tools

Thu, 02 Jun 2011 21:07:43 -0400

Mike Harrison has a website with some great tools, namely a password cracker and SpotLight query tool. The Download page is found here.

Elcomsoft Password Recovery Software

Thu, 02 Jun 2011 21:07:14 -0400

Elcomsoft has release their latest in password recovery supporting all iOS devices. It is available in commercial and law enforcement versions. Read more on their site here.

Tenable Guide to Hardening OS X

Thu, 02 Jun 2011 21:06:22 -0400

Tenable, probably best know for Nessus, has written “Hardening OS X Using The NSA Guidelines” on their blog.

Cellebrite Physical Pro v2

Thu, 02 Jun 2011 21:02:28 -0400

Cellebrite has released v2 of their Physical Pro which has an enormous amount of features for iOS device imaging and analysis compared to the previous version. Read more about their current release here.

Disk Arbitrator by Aaron Burghardt updated to version 0.4.0

Fri, 22 Apr 2011 19:40:00 -0400

Disk Arbitrator updated to 0.4.0 - Aaron Burghardt has updated his utility for controlling Disk Arbitration on OS X. New features include mode and application state are saved as preferences whenever the app is restarted.

"Digital Smoke, The Art of Incident Response" by Al Lewis updated and posted

Fri, 22 Apr 2011 18:42:54 -0400

“Digital Smoke, The Art of Incident Response” by Al Lewis - Al Lewis has contributed his most recent white paper on OS X and Macintosh incident response. Al is veteran Macintosh researcher, programmer, and analyst. Both part 1 and part 2 can be found from the lead page of our website.

iPhone Backup Analyzer released by Mario Picci

Thu, 21 Apr 2011 17:48:13 -0400

iPhone Backup Analyzer - this is a new, open source project from Mario Picci and the University of Brescia. The utility is designed to allow the user to simply browse through the contents of the backup folder of an iOS device.

AccessData has released AD Triage

Wed, 13 Apr 2011 21:18:29 -0400

AccessData has released a new tool, AD Triage, that supports “powered-down Macs with Intel processors”. This new tool is built as an on-scene preview and acquisition tool and uses FTK technology.

AccessData releases Mobile Phone Examiner (MPE+) Field Tablet for Mobile Phone Forensics

Wed, 13 Apr 2011 21:16:45 -0400

AccessData releases Mobile Phone Examiner (MPE+) Field Tablet for Mobile Phone Forensics with support for over 2500 phones, which includes the logical and physical support for the iPhone, iPad and iPod Touch without “jailbreaking” of the device. Support is for both the CDMA and GSM versions of the iPhone. See AD’s website for full details of the device.

Editor's Note on the XCode4 Alert and Property List Editor

Tue, 05 Apr 2011 20:28:26 -0400

Thank you to some of the kind readers for pointing out the wording of the alert. Functionality has not been lost with the update of XCode4 and the removal of Property List Editor. The XCode4 programming application itself is the viewer of PLIST files now. Analysts may have the preference as I to keep the old utility around because of its small size and ability to save on the "Portable OS X Workstation" for easy PLIST file viewing.

Free Tools from BlackBag Technologies

Mon, 04 Apr 2011 22:33:11 -0400

BlackBag Technologies has a slew of tools available to assist in the analysis of OS X and iOS devices. Take a look at their page of tools available at no cost.

Shadow File and FileVault Crack by Sarah Edwards

Mon, 04 Apr 2011 19:14:53 -0400

Sarah Edwards has written a very nice article on her blog about using John the Ripper to attack the Shadow hash file and using the resulting password to open a user’s FileVault encrypted Home Folder

XCode 4 and Mac Forensics ALERT

Mon, 28 Mar 2011 11:59:00 -0400

XCode 4 and Mac Forensics ALERT - installing XCode 4 will remove a utility we have come to love and use during OS X analysis, Property List Editor. The tool has been incorporated into XCode itself now. In order to continue to use this great application, save the application outside of your Developer folder before upgrading!

"Malicious Streams" website by Joel Yonts offers free Tools for OS X processing

Tue, 08 Mar 2011 21:13:55 -0500

Joel Yonts’ Website, Malicious Streams, has made available some very interesting OS X tools. The tools, “OS X AutoRuns, FSDiff Tool & Modified FsLogger Tool” are all offered free of charge, but Joel is asking for lots of feedback. As with all tools, they can’t get better until the developer knows what is going well and not so well. Please let him know we sent you to. (He has written a great manual available here.)

MacQuisition v2.53 released from BlackBag Technologies

Wed, 02 Mar 2011 10:49:35 -0500

BlackBag Technologies has announced the release of MacQuisition v2.53. It offers the ability to boot PPC and Intel Macs and image each to a collection drive. See their website for full details.

Lantern v2.0 released

Mon, 28 Feb 2011 10:33:20 -0500

Katana Forensics LLC has released their latest in iOS device analysis with Lantern v2.0. See their website for the long list of new features and bug fixes.

Mac Marshal v2.0.3 has been released by ATC-NY

Sun, 27 Feb 2011 23:51:49 -0500

ATC-NY has updated Mac Marshal to version 2.0.3 with enhancements and bug fixes. This software still remains the only available software to collect the RAM from a running OS X device (aside from their command line version of the same tool)

Apple Examiner Reader Reminder - call for contributiions, news about updates, versions or apps

Sun, 27 Feb 2011 23:51:07 -0500

Reader Reminder - this website is kept up-to-date by all of us as a community. Please freely send me links to great articles, news about Apple digital forensic updates, new versions of programs we all like to use, or simply something I have failed to list in one of the sections. This is our site. Thank you to everyone for your help and contributions!

REMINDER: This includes all companies. Please email me with news of your latest versions so I can spread the word!

MacQuisition by BlackBag Technologies and Imaging the Macbook Air

Tue, 22 Feb 2011 20:20:25 -0500

MacQuisition by BlackBag Technologies and Imaging the Macbook Air - a blog post has just been made giving excellent insight to each of the different methods available to imaging the MB Air on the BlackBag Blog

Portable OS X Workstation (USB, Firewire or eSATA)

Mon, 21 Feb 2011 14:09:50 -0500

We have written an article on creating your own Portable OS X Workstation to boot OS X from a USB, Firewire or eSATA connected drive. This offers the ability to image, and conduct field forensics on any Mac with the correct installation. This will even get you into that pesky MB Air. Read more here to get our tips.

Guidance Software updates Neutrino for compatibility with iOS devices

Mon, 14 Feb 2011 17:24:56 -0500

Guidance Software has released a new version of Neutrino that supports the iOS devices.

Emailchemy updated to version 10.1 (updated the weblink to the full change blog)

Mon, 14 Feb 2011 17:23:56 -0500

Emailchemy 10.1 has been released. There are many features added since the last release. See their website for full details.

GPSForensics blog has unique article for iPhone acquisition

Thu, 10 Feb 2011 22:23:05 -0500

GPSForensics has a unique article on acquiring the data from an iPhone with the help of a great utility from Erica Sadun called MDHelper.

Mobile Device Forensics blog by Mike Harrington

Thu, 10 Feb 2011 22:22:16 -0500

Mike Harrington has been producing a great blog called Mobile Device Forensics with many of the latest tidbits and techniques for devices including iOS devices.

MobileSyncBrowser updated to version 4.2

Thu, 10 Feb 2011 22:20:35 -0500

MobileSyncBrowser v4.2 has been released. There are 3 versions available, regular, Pro , and law enforcement.

Imaging a Mac

Wed, 02 Feb 2011 12:57:09 -0500

From the SANS Blog “How To: Forensically Sound Mac Acquisition In Target Mode” by Paul Henry, this article goes into great depth of using TDM vs. pulling the hard drive from a Mac for imaging. The article shows techniques and tools from many vendors and sources.

USB Entries on OS X

Wed, 02 Feb 2011 12:35:16 -0500

BlackBag Technologies has posted on their blog a great new feature of 10.6.5 and later of USB device logging. We have added it to our new page, USB Entries on OS X where we list other areas of interest for media entries as well.

Safari as a File Viewer

Wed, 02 Feb 2011 12:34:18 -0500

Sean Cavanaugh has written as article on using Safari to view PLIST files. The article is written from the perspective of Safari on Windows which shows how to view PLIST files without installing any other tools.

BlackBag Technologies announces BlackLight for OS X and Windows operating systems

Sun, 30 Jan 2011 07:43:38 -0500

BlackBag Technologies is on a roll this month with announcements. They have just released the latest BlackLight which is available on both OS X and Windows operating systems. They are feature for feature equals. This is great news for the OS X and iOS analyst.

iFixIt details Apple's new Pentalobe security screws

Fri, 21 Jan 2011 07:17:29 -0500

iFixIt has detailed the new screws (Pentalobe) Apple is/will be using to secure iOS and OS X devices. They also have the tools for sale at their site if you aren’t into making them yourself.

Mac Memory Acquisition command line tool released

Wed, 19 Jan 2011 06:14:32 -0500

The people behind Mac Marshal have given the community a late holiday gift by releasing the Mac Memory Acquisition command line tool. According to their team, “we've decided to release the memory dump command-line tool from Mac Marshal separately as a free download. Our hope is that it will spur the Mac RAM R&D community by providing actual raw data.”

BlackBag Technologies rolls Mobilyze into BlackLight

Wed, 19 Jan 2011 06:13:45 -0500

BlackBag Technologies has rolled Mobilyze, their iPhone/iPad/iPod Touch analysis tool into the purchase of BlackLight.

iPhone Carrier Select

Fri, 31 Dec 2010 09:33:46 -0500

iPhone Carrier Select - the iPhone has the ability to automatically choose the carrier for voice and data services. We take a look at the selection ability in this article.

Bluetooth Analysis with Bluetooth Explorer

Fri, 31 Dec 2010 08:07:02 -0500

Bluetooth Analysis - Bluetooth Explorer is an application included with Apple’s Developer Tools. We have an article showing how you might be able to use it during your analysis.

iOS Airplane Mode information

Fri, 31 Dec 2010 08:06:07 -0500

iOS Airplane Mode - we have posted an article about the nuances of iOS Airplane Mode and how it doesn’t always isolate the radios of the devices from the network.

BlackLight from BlackBag Technologies article

Wed, 01 Dec 2010 22:45:39 -0500

BlackLight from BlackBag Technologies - we have written an article about the key features of the new digital forensic suite from BlackBag Technologies and how it can make your laboratory much more productive when analyzing Apple products.

MacForensicsLab Social released by SubRosaSoft.com Inc.

Wed, 01 Dec 2010 22:44:41 -0500

MacForensicsLab Social - SubRosaSoft.com Inc. announces the immediate availability of MacForensicsLab Social Agent™ 1.0. Social Agent™ is designed to get evidence from chats, private messages, and blog activity on Facebook and other social networking websites.

iPhone Forensics white paper updated by Andrew Hoog of via Forensics

Wed, 17 Nov 2010 14:37:20 -0500

Andrew Hoog of viaForensics has written a follow-up to his iPhone Forensics white paper. With this update, he looks at the latest tools and techniques available to examiners.

Macbook Air Take Apart article updated by Lee Whitfield

Wed, 17 Nov 2010 14:36:28 -0500

Lee Whitfield has written a follow-up article on removing and acquiring the LIF drive of the newer Macbook Air models.

Mac Marshal v2

Tue, 09 Nov 2010 17:29:40 -0500

ATC-NY has just released Mac Marshal 2.0, an update to its tool for analyzing Mac OS X systems. The update adds significant new OS and application analysis capabilities, streamlines the analysis of E01-format images, and adds new live analysis features. The new Mac Marshal Field Edition also runs directly on a Mac target machine from a USB drive, extracting volatile system state data including a snapshot of physical RAM.

BlackLight Release 2

Tue, 09 Nov 2010 17:29:11 -0500

BlackBag Technologies has released an update to their latest tool that includes several fixes and updates. See their website for full details.

fileXray

Tue, 09 Nov 2010 13:16:25 -0500

fileXray from iohead is a collection of command line tools that can analyze the HFS+ file system in ways such as disabling auto-mount of volumes, analyzing the volume journal, scavenge of deleted content, viewing of real-time file system activity, and much more. See the website to view the complete details of what has been termed “hfsdebug on steroids”.

MacForensicsLab Write Controller

Tue, 09 Nov 2010 13:15:32 -0500

a new utility from SubRosaSoft Inc. has been released that allows an analyst to control auto-mounts of any device and prevent accidental writing to drives.

MobileSyncBrowser updated

Tue, 09 Nov 2010 13:14:44 -0500

MobileSyncBrowser has been updated to version 4.1.2 to handle the most current iOS from Apple and all devices.

FaceTime

Tue, 09 Nov 2010 13:13:57 -0500

Apple has just released a new communication application for the Mac. We have a quick breakdown of the interesting files.

Blacklight 1.0 released from BlackBag Technologies

Thu, 23 Sep 2010 21:35:21 -0400

BlackLight offers both advanced users and novice Mac forensic professionals an elegant, yet comprehensive platform for analyzing Mac data. In addition to traditional carving, searching and file analysis concepts, BlackLight offers a unique gallery view for quickly viewing and tagging thousands of pictures. Built natively to handle Mac data, BlackLight handles sparse bundles and other native Mac files seamlessly without relying on Windows interpretation. Beyond analysis, BlackLight offers flexible and customizable reports for summary and final case submission.

Mobilyze 1.2 from BlackBag Technologies released

Thu, 23 Sep 2010 21:34:19 -0400

BlackBag Technologies has released version 1.2 of their iPhone, iPad and iPod Touch analysis software.

FTK Imager for Mac GUI

Thu, 16 Sep 2010 21:48:26 -0400

FTK Imager for Mac GUI - this is the FTK Imager by AccessData with a Graphical User Interface added to it. It is in beta now. Please read the included notes before using. I welcome your feedback!

Safari Quick Notes

Thu, 16 Sep 2010 21:47:40 -0400

Safari Quick Notes - A quick reference to the places of interest when examining Safari v5 and v4.

Creating an OS X IR CD

Thu, 16 Sep 2010 21:42:11 -0400

Creating an OS X IR CD - Tom Webb has written a great article on creating your own CD to carry Command Line tools for Incident Response

Apple Technical Docs Updated

Thu, 16 Sep 2010 21:41:26 -0400

Apple Technical Docs have been updated with links to documents that relate to digital analysis and incident response.

Mobilyze 1.1 released

Wed, 25 Aug 2010 20:28:08 -0400

BlackBag Technologies has released version 1.1 of their iPhone, iPad and iPod Touch analysis software.

Disk Arbitrator 0.3.2 released

Wed, 25 Aug 2010 20:27:36 -0400

an update has been posted which takes care of a small bug in the user interface when attempting to Shows Disks.

MobileSyncBrowser v4

Wed, 25 Aug 2010 20:26:59 -0400

The latest version of MobileSyncBrowser is available from Vaughn Cordero

Epoch Time Convertor (link has been fixed, sorry for the mistake)

Wed, 25 Aug 2010 20:25:49 -0400

I have just uploaded a simple Applescript application that converts Epoch time to Calendar time.

iPhone Tool Classification PDF version now available

Sun, 08 Aug 2010 20:52:54 -0400

We have just made Sam Brothers article, "iPhone Tool Classification" available in PDF format. It look much cleaner than the HTML version. Visit this link to obtain the article in PDF format.

iPhone Tool Classification

Sun, 01 Aug 2010 16:50:03 -0400

Sam Brothers has written a new article titled iPhone Tool Classification. In this article, he explores the varying degrees of data extraction that can be performed on the iPhone with many of the available tools today. This article breaks down the level of “intrusiveness” each tool or method has and compares it to the data obtained.

Safari Browser Analysis

Sun, 01 Aug 2010 16:49:16 -0400

Selena Ley has written a new article about Safari Browser Analysis. In this article, she explores the files that you will find useful when performing a Macintosh or Windows examination with Safari installed.

Pieces of Eight: iPods, iPads, iPhones, and SQLite by Mike Harrington

Sun, 01 Aug 2010 16:48:31 -0400

A new article on DFI News website titled “Pieces of Eight: iPods, iPads, iPhones, and SQLite” should be of interest to you. Mike Harrington has written about SQLite files and how they pertain to the iPhone, iPad and iPod Touch. SQLite3 is heavily used throughout OS X and this article is an excellent read.

Mobilyze from Blackbag Technologies reviewed by The Apple Examiner

Sat, 29 May 2010 21:03:03 -0400

We have reviewed BlackBag Technologies Mobilyze application with this article. We run thru a few of the prominent features of the application, drill down to pertinent case data, and generate a sample report.

Mounting HFS+ in Linux

Tue, 25 May 2010 21:16:01 -0400

Andy Hoog of viaForensics has written a great blog post regarding mounting HFS+ partitions in the Linux operating system.

Access Data releases FTK Imager for Macintosh

Mon, 24 May 2010 19:19:59 -0400

Access Data has released a command line version of its free FTK Imager. A link to their downloads page is available at our site.

FTK v3 & Macintosh Forensics

Sat, 22 May 2010 20:45:06 -0400

an article written by Brian Salmon showing the new features of Access Data’s latest release of FTK and how it applies to analyzing Macintosh data.

Raptor v2 Released

Fri, 21 May 2010 18:49:22 -0400

Forward Discovery has released Raptor v2 of its Linux boot CD. See their website for full details of all of the new features of the boot CD and the new bootable USB device.

The Sleuth Kit and Mac OS X

Mon, 17 May 2010 21:02:32 -0400

an article we have written to show the power of Brian Carrier’s Sleuth Kit in creating timelines with HFS+ file systems. The Sleuth Kit includes several command line utilities that can give in-depth looks in many different file systems. In this article, we take a look at ‘fls’ and ‘mactime’ to create a timeline of events on an OS X live system.

Emailchemy 9.9.2 released

Mon, 17 May 2010 21:01:47 -0400

Weird Kid software has released version 9.9.2 of their email conversion utility offering additional features and fixes.

Goldfish memory analysis

Mon, 17 May 2010 21:01:17 -0400

Goldfish is Memory analysis tool for Mac OS X and available for Law Enforcement only. More information is available from their website.

Access Data FTK 3.1.1 released

Tue, 11 May 2010 20:51:22 -0400

Access Data has released version 3.1.1 of their Forensic Toolkit. Forensic Toolkit offers features for interpreting OS X data not found in other products running on the Windows OS. Version 3.1.1 notable features for Macintosh examiners include H.264 support, Optical Character Recognition (OCR) during preprocessing, and custom data carvers.

F-Response TACTICAL Updated

Tue, 11 May 2010 20:50:13 -0400

F-Response TACTICAL has been updated to version 3.09.07 which includes several new features. Notable enhancements include all versions having physical memory access for both 32 and 64 bit Windows environments, streamlined F-Response Scripting Object, and a new F-Response Linux boot CD.

F-Response Training Videos

Tue, 11 May 2010 20:48:45 -0400

F-Response has released a series of training videos including videos on Apple/Macintosh digital forensics. The videos can be found here and should be useful to anyone using the product.

Mobilyze 1.0 from BlackBag Technologies released

Sat, 01 May 2010 08:23:18 -0400

BlackBag Technologies has released Mobilyze 1.0. This is a new tool from them that is specifically designed to analyze iPhone, iPod Touch and iPad devices. Take a look at their in-depth description here.

Mac OS X Forensics becomes The Apple Examiner

Thu, 22 Apr 2010 11:12:13 -0400

Our website is dedicated to bringing you the most information about all Apple products and how to safely and effectively analyze each. In consideration of that goal, we have revamped the site, along with a new name, The Apple Examiner. Hopefully you will find the new look, layout, and articles of even greater value than in the past. Thank you again for all of the success over the last 3 years.