AboutDFIR.com – The Definitive Compendium Project
Digital Forensics & Incident Response

For information on file signature analysis (OS agnostic and file-type specific), please check out Gary Kessler’s File Signature Table

Artifact or ProcessResourceDescription
APOLLOExploring macOS with APOLLO
APOLLONew Webinar: Analyzing macOS with BlackLight's APOLLO Plugin
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 8] – Man! What a process!?
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 9] – We all know you're binging Netflix! Now Playing on your Apple Devices!
Apple Unified LogsAnalysis of Apple Unified Logs: Quarantine Edition [Entry 10] – You down with TCC? Yea, you know me! Tracking App Permissions and the TCC APOLLO Module
BookmarksBookmarks, a type of Alias: their access and use
DiscordFinding Discord chats in OS X
iOS Apps on M1Taking a gander at iOS apps on an M1 Mac
macOSApple Computer and MacOS Basics
macOS - AirDropAirDrop Forensics 2
macOS - Big SurBig Sur, Big Changes
macOS - CatalinaCatalina: A Voyage Through Apple’s New ArtifactsYouTube video by BlackBag Technologies
macOS - Daily LogsMac OS Daily Logs
macOS - Extended AttributesThere’s more to files than data: Extended Attributes
macOS - InteractionC.DB Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
macOS - Sysdiagnosesysdiag-who?
macOS - T2 ImagingMagnet Virtual Summit // MacOS Forensics: The Next Level - Taming the T2 Chip and MoreYoutube presentation about how to image T2 macs with only built-in mac tools, and then process with mac_apt framework
Microsoft TeamsPart of a Sunday Funday Answer - Microsoft Teams
Microsoft TeamsMicrosoft Teams and Skype Logging Privacy Issue
Safari macOS - Safari Preferences and Privacy
SafariiOS / macOS - Tracking Downloads from Safari Without Downloads
Screentime Notifications Screentime Notifications in Catalina (10.15)
SignalPulling encrypted Signal messages off of desktop OS’ for forensicsHands-on lab detailing a new open-source (AGPL) platform to perform surgical forensic evidence collection and incident response across a distributed computer network
SkypeMicrosoft Teams and Skype Logging Privacy Issue
tvOSAPOLLO and tvOS – It Just Works! (...and judges me for binging TV)
Universal Serial Bus (USB)USB Forensics
Universal Serial Bus (USB)USB 101
VelociraptorVelociraptor - Dig Deeper