This Is A Custom Widget

This Sliding Bar can be switched on or off in theme options, and can take any widget you throw at it or even fill it with your custom HTML Code. Its perfect for grabbing the attention of your viewers. Choose between 1, 2, 3 or 4 columns, set the background color, widget divider color, activate transparency, a top border or fully disable it on desktop and mobile.

This Is A Custom Widget

This Sliding Bar can be switched on or off in theme options, and can take any widget you throw at it or even fill it with your custom HTML Code. Its perfect for grabbing the attention of your viewers. Choose between 1, 2, 3 or 4 columns, set the background color, widget divider color, activate transparency, a top border or fully disable it on desktop and mobile.

Articles

/Articles
­

Plist Survival – Finding Auto-run Applications on a Mac

By |February 14th, 2016|Articles, Mac Forensics|

A question that sometimes comes up in an investigation is: What is the computer system is doing "on its own?"  In other words, are there any programs set to start when the Mac is booted?  If so, are they relevant to the case? On a Windows system this information is tucked away in several locations [...]

Do you have MAC “Cooties”?

By |February 14th, 2016|Articles, Mac Forensics|

Have you ever plugged in a USB drive from a Mac into a Windows system and seen this: Well, congratulations!  You have Mac "Cooties".  I hope your shots are up-to-date! What are these files any way?  On an OS X system the Spotlight feature indexes a lot of metadata, and I mean a lot.  This [...]

iPhones Storing Historical Location Data

By |February 14th, 2016|Articles, iPhone Forensics|

iOS has a built in feature that, as far as I can tell, is working like GPS locator.  I have been testing this and so far all the dates, times and map locations that my iPhone is collecting are accurate.  This feature is on by default and all you need is access into the device [...]

Safari Private Browsing not so Private

By |February 14th, 2016|Articles, Mac Forensics|

Safari’s Private Browsing feature may not be so private after all.  Well, at least in part.  I was thinking about this as I was checking out a new Quarantine Event forensic plugin in RECON for Mac OS X.  I did a test on OS 10.10 where I downloaded a file using a “Private Window” in Safari. [...]

Plist Survival: Is Trash set to Secure Erase?

By |February 14th, 2016|Articles, Mac Forensics|

Most Mac users can tell you that you have two options when deleting files: a simple delete or Secure Erase.  The default in 10.7+ is a simple delete whereby the deleted file is placed into the User's Trash.  The file may be rescued by way of the "Put Back" option or deleted from Trash, also [...]

Plist Survival: Finding the Mac OS version of your evidence

By |February 14th, 2016|Articles, Mac Forensics|

Finding the version of OS X on a live target system is straight-forward.  You simply select the Apple icon located in the upper left corner then select "About this Mac."  Here you can find all sorts of system information to include the version of OS X. On a dead box exam you must check the [...]

Tale of Two .Trashes

By |February 14th, 2016|Articles, Mac Forensics|

Recently a student posted this question: "A question regarding .Trashes: Which deleted data is saved on the boot volume .Trashes? If a file was deleted from an external volume it goes to the .Trashes of the external volume and not to the .Trashes of the boot volume or not?" Here's the short answer:   It goes to [...]