Our website may use cookies to improve and personalize your experience and to display advertisements (if any). Our website may also include cookies from third parties like Google Adsense or Google Analytics. By using the website, you consent to the use of cookies. We’ve updated our Privacy Policy. Please click on the button to check our Privacy Policy.

AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

For information on file signature analysis (OS agnostic and file-type specific), please check out Gary Kessler’s File Signature Table

Artifact or ProcessResourceDescription
APOLLOExploring macOS with APOLLO
APOLLONew Webinar: Analyzing macOS with BlackLight's APOLLO Plugin
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 8] – Man! What a process!?
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 9] – We all know you're binging Netflix! Now Playing on your Apple Devices!
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 10] – You down with TCC? Yea, you know me! Tracking App Permissions and the TCC APOLLO Module
BookmarksBookmarks, a type of Alias: their access and use
DiscordFinding Discord chats in OS X
iOS Apps on M1Taking a gander at iOS apps on an M1 Mac
macOSApple Computer and MacOS Basics
macOS - AirDropAirDrop Forensics 2
macOS - Big SurBig Sur, Big Changes
macOS - CatalinaCatalina: A Voyage Through Apple’s New ArtifactsYouTube video by BlackBag Technologies
macOS - Daily LogsMac OS Daily Logs
macOS - Extended AttributesThere’s more to files than data: Extended Attributes
macOS - InteractionC.DB Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
macOS - Sysdiagnosesysdiag-who?
macOS - T2 ImagingMagnet Virtual Summit // MacOS Forensics: The Next Level - Taming the T2 Chip and MoreYoutube presentation about how to image T2 macs with only built-in mac tools, and then process with mac_apt framework
Microsoft TeamsPart of a Sunday Funday Answer - Microsoft Teams
Microsoft TeamsMicrosoft Teams and Skype Logging Privacy Issue
Safari macOS - Safari Preferences and Privacy
SafariiOS / macOS - Tracking Downloads from Safari Without Downloads
Screentime Notifications Screentime Notifications in Catalina (10.15)
SignalPulling encrypted Signal messages off of desktop OS’ for forensicsHands-on lab detailing a new open-source (AGPL) platform to perform surgical forensic evidence collection and incident response across a distributed computer network
SkypeMicrosoft Teams and Skype Logging Privacy Issue
tvOSAPOLLO and tvOS – It Just Works! (...and judges me for binging TV)
Universal Serial Bus (USB)USB Forensics
Universal Serial Bus (USB)USB 101
VelociraptorVelociraptor - Dig Deeper