dfloyd888

dfloyd888, 23 days ago to random

Is it me, or does macOS have a ton of ways that a forensics examiner can easily tell when files were accessed? Be it Spotlight caches, the .fseventsd log which writes when files were modified, oddball permissions. Macs are a gold mine if captured and examined. Don't forget the "._" files that are thrown around everywhere as a way to add attributes.