Limitations of Other Forensic Tools when Performing Digital Investigations on Mac OS X (1100 words)

In three pages, convince the reader that Mac forensics analysis is best completed when using a Mac system. Lay out all the reasons with specific details including feature or functionality that can’t be translated or is not optimally translated in the process.

The student will investigate and be able to explain the potential issues surrounding the use of alternative file systems to conduct Mac forensics examinations.

Whether the comparison is made between live capturing tools or image acquisition tools, Mac operating system cannot be fully examined using either a Windows-based forensic tool or even a Linux/UNIX based forensic tool, from several reasons:
- There are certain features specific to Mac OS X that cannot be translated by other similar tools (e.g. PLIST exploration and display, file system- DMG images are not fully supported by other forensic tools);
- The examiners who are not very aware of file locations and paths from a Mac system can fail when searching for digital evidences when they are using tools designed for other operating systems or even a compatible type of operating system;...

This is only a preview of the solution. Please use the purchase button to see the entire solution