Assignment Lab 6
Chapter 19
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Forensic Examination of Macintosh Systems
Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.1 (A) File record interpreted using Norton Disk Editor. (B) Same file record in hexadecimal form.
Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.2 HFS viewed in EnCase showing Catalog file record from Figure 19.1.
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.3 Norton Unerase.
Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.4 IE Cache.waf file viewed using WAFInspec.
Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.5 Entries in a keychain database from Mac OS X system.