Posted on

MacForensicsLab Tips and Tutorials – Part Three

Part One

Part Two

Part Three

Imaging a Drive via Target Disk Mode Tips - Imaging a Drive via Target Disk ModeSometimes an investigator may not have access to a hardware write blocker or may not be able to remove the suspect drive from their Mac (we do not recommend investigators attempt to image a drive without a hardware write blocker but at times situations may necessitate it). In this case the investigator can connect the suspect Mac to their forensic workstation to process the investigation using a process called Target Disk Mode. Target Disk Mode causes the suspect Mac to act like an external drive at which point it can then be connected to a forensic workstation running MacForensicsLab for imaging and examination.

  1. The first and MOST important step in this process is making sure that Disk Arbitration is disabled. You can do this by following the process for disabling Disk Arbitration found here. Make you verify that it is disabled using Disk Utility once you have completed this. This will ensure that the suspect drive stays forensically sound.
  2. Boot the suspect Mac and hold down the “T” key until a diak icon appears on screen. The suspect machine is now in Target Disk Mode.
  3. Connect the suspect machine to your examination workstation. Target Disk Mode supports FireWire, Thunderbolt 2, USB-C, or Thunderbolt 3 (USB-C) ports. Once the suspect drive appears in MacForensicsLab’s Device area, you can proceed with acquiring an image of it (note: the suspect drive will not appear on the desktop as Disk Arbitration is disabled).
  4. Once the image has been created, you can hold down the power button on the suspect machine until it powers itself off. Then disconnect it from the examination machine.
MacForensicsLab’s Software Write Blocking function will not work on El Capitan and Sierra. If you are running OS X 10.11 or OS X 10.12, please use a hardware write blocker instead.


Starting Points For A Mac OS X Investigation Tips - Starting Points For A Mac OS X InvestigationWhen processing an investigation of a suspect’s Mac OS X hard drive using MacForensicsLab there are several places that you may want to start your search. These folders are present on all versions of Mac OS X and contain a great deal of information that will help the investigator to show intent and may also give them a better idea of where they should look next.

A good place to start forensic discovery on any Mac OS X machine is inside the ~Users/“USERNAME”/ folder. Within this folder you can find sub-folders containing large amounts of user data. Many peer-to-peer applications create folders here and many times there are other user-created folders found here.

The ~/Users/“USERNAME”/Library folder and it’s sub-folders have a vast amount of usable forensic material. Some sub-folders of interest in here are; Caches, Calendars, Cookies, Keychains, Logs, Mail, Preferences, Recent Servers, and Safari. Any of these can be examined with MacForensicsLab’s Analyze function or the Salvage function depending on the kind of data discovery you are after.

The ~/Users/“USERNAME”/Documents is the default save-to folder for many applications and many users use this folder to store everything from text documents to pictures and movies.

The ~/Users/“USERNAME”/Pictures folder if the default storage location for Apple’s iPhoto. Photos loaded into iPhoto are stored here in the iPhoto Library folder in iPhoto version before ’08. In iPhoto ’08 the iPhoto Library folder is replaced by a package with the same title. Many users use this folder to store images from other applications also.

The ~/Users/“USERNAME”/Movies folder is the default storage location for many video editing applications including Apple’s iMovie. Many users use this folder to store video files on their system.

Turning On Software Write Blocking Tips - Turning On Software Write BlockingWhen creating a forensically sound image of a suspect drive, care must be taken to insure that the suspect evidence is not compromised. This is usually done through the use of a hardware write blocker connected to the drive. The write blocker allows information to be read from the suspect drive but will not allow the acquisition computer to write data to the drive, thus preventing the information from being compromised.

MacForensicsLab’s Software Write Blocking function will not work on El Capitan and Sierra. If you are running OS X 10.11 or OS X 10.12, please use a hardware write blocker instead.

If you do not have access to a hardware write blocker and need to image a suspect drive, you can use MacForensicsLab’s Disable Disk Arbitration option to disabled writing to the drive.

The process to use MacForensicsLab to disable Disk Arbitration is as follows.

  1. Turn off Disk Arbitration from File menu. You can verify that it is disabled by attempting to launch Disk Utility. If Disk Arbitration is disabled, Disk Utility will not launch.
  2. Plug drive in/power-up or insert media card.
  3. Go back to File Menu and select “Rescan Bus”.
  4. Drive/media will now be visible within MacForensicsLab.
  5. Image drive with the Acquire function.
  6. Disconnect drive BEFORE turning Disk Arbitration back on the same way you turned it off.

MacForensicsLab highly recommends that a hardware write blocker be used when acquiring an image of a suspect drive.

Why Won’t My Acquired Disk Image Mount on The Desktop Tips - Why Won't My Acquired Disk Image Mount on The DesktopDoes your acquired disk image refuse to mount on the desktop? If you have selected the option to turn off Disk Arbitration when MacForensicsLab launches or disabled Disk Arbitration by selecting the option from the Window menu, Disk Utility will not be able to mount any images until Disk Arbitration is turned back on. This issue can be resolved using either of these options.

Re-enabling Disk Arbitration can be done either by selecting the Disk Arbitration option from the Window menu within MacForensicsLab again and enabling it or by rebooting your Mac. Many times Disk Arbitration can be turned off and forgtten about because of MacForensicsLab’s ability to see drives at the device level. This means you can still work with disk images within MacForensicsLab even without mounting them on the desktop as you normally would. If you’re still having problems mounting disk images after re-enabling Disk Arbitration in MacForensicsLab restart your computer.

Posted on

MacForensicsLab Tips and Tutorials – Part Two

Part One

Part Two

Part Three Tips - Erasing a Target Drive

Erasing a Target Drive

This lesson demonstrates how to erase a target drive.

Open Preferences Window

Securely erasing a drive will overwrite the contents of the device to insure that no data can be recovered. This process involves overwriting every block of data on the drive one or more times to insure that no trace of the previous information on the device remains. Simply deleting the data on a drive does not actually erase it but rather only frees that space to be overwritten by new data.

Before imaging a suspect device to a target drive it is necessary for the investigator to first wipe the existing data on the target drive. This insures that the target drive is free of any information from previous investigations and insures the integrity of the suspect evidence. Clearing the target drive can be done either using Apple Disk Utility or MacForensicsLab.
Using Apple Disk Utility to erase your target drive

Locating the Applications folder on Mac OS X

To clear the acquisition drive using Apple Disk Utility, first open the Mac’s hard drive and locate the Applications folder and open it.

Finding the Utilities folder in Mac OS X

Find and open the Utilities folder and open it.

Finding Disk Utility in Mac OS X

Locate and open the application Disk Utility.

Setting up Disk Utility to wipe an aquisition drive.

First select the target drive you wish to wipe by clicking it on the left side. Next click the "Erase" toolbar option at the top of the window. Finally click the Security Options… button at the bottom of the window. If you would like, give the drive a name by entering it in the name area.

Selecting secure erase options in Disk Utility

In the Secure Erase Options the investigator can then select the desired method of erasing. Then click OK.

Secure erasing a drive

Click the Erase button to start erasing the target drive. A progress bar will indicate the status of the device erasure.

Using MacForensicsLab to erase your target drive

Selecting device to erase with MacForensicsLab

First select the target drive you would like to erase in the Device area of MacForensicsLab in the upper left corner.

Selecting Clear Work Drive in MacForensicsLab

With the desired device selected, go to the File menu and select Clear Work Drive.

Selecting secure erase options in MacForensicsLab

Select the number of passes you would like to make when erasing the data on your target drive. This can be done by either using the slider or entering the desired number in the box. When you have set the desired number of passes, click the Start button.

Operation cannot be undone

MacForensicsLab will inform you that the operation cannot be undone. Make sure you have selected the correct device and then click the OK button.

MacForensicsLab secure erase status

The shred process will begin and a status window will show the current progress of the task. When the device has been erased the software will notify the user that the process has completed.


Finding Child Pornography with the Skin Tone Analyzer

This lesson demonstrates how to use the skin tone analyzer feature of MacForensicsLab. Tips - Finding Child Pornography with the Skin Tone AnalyzerThe distribution of child pornography is one of the most disturbing cyber crimes. With the growth of the internet and the ease of file-sharing these days, child pornography has grown to become a world wide issue. Dealing with the exploitation of children in a sexual manner has become a big issue for law enforcement around the world. These cases sometimes involve thousands of images and finding the right ones can become a huge task.

Finding the digital evidence can be a real headache when it’s mixed in with thousands of unrelated images. To make an investigator’s job easier, MacForensicsLab offers a built-in skin tone analyzer. This feature quickly filters out images of interest based on a number of user entered parameters. The investigator filter their results based on any combination of the following criteria:

  • Percentage of skin tone contained in the image.
  • Minimum and maximum file size.
  • Vertical and horizontal minimum and maximum pixel size.

You can use the browse function to quickly locate and display potential evidence of child pornography.

By using these simple parameters an investigator can narrow a search for suspect images down from hundreds of thousands to just a couple hundred (or even less). This can save the investigator hours of time that would have been spent manually searching through images that had no relevance to their case.

Forensic Image Hash Validation Tips - Forensic Image Hash Validation>The ability to obtain a valid forensic image is critical to the successful completion of a forensic examination. Therefore, as with all forensic tools, it is encumbant upon the examiner to validate their current tools against well documented and validated tools; this should be done every time there is an update to your softwware.

As an example, to validate a forensic image acquired under MacForensicsLab, open a terminal window and type: openssl md5 (path and device name – i.e. /dev/rdisk1) now compare the output with that of MacForensicsLab, they should match.

Forensic Imaging of the Amazon Kindle Tips - Forensic Imaging of the Amazon KindleThe Amazon Kindle is currently the most popular ebook reader on the market. With expected sales of 5 million Kindles in 2010 and up to 11.5 million in 2012, the popularity looks to continue to increase. The Kindle can store a wealth of information, not only limited to ebooks but also notes, music, search information, and other items of interest to a forensic investigator. It can also be used as a USB storage device. With 4GB of internal storage, the Kindle 3 can hold a wealth of data. Other Kindle models have less internal storage but can still valuable suspect data.

Examining the Amazon Kindle

Connecting the Kindle

Amazon Kindle 3 connected is USB

The Kindle uses a standard Micro USB cable (not to be confused with Mini USB which looks similar but is slightly larger). Attach a Micro USB to USB cable to the USB port on the Kindle and plug the standard USB end into a USB write blocker, such as the WiebeTech USB WriteBlocker, then connect the write blocker to the forensic workstation (first making sure to disable Disk Arbitration on the Mac first, for an extra layer of protection against accidental mounting of the device).

Imaging the Kindle

Selecting the Kindle device for forensic imagine in MacForensicsLab

Once the Kindle has been connected to a USB write blocker and connected to the forensic workstation, the device should appear in the MacForensicsLab Device/Volume area. Select the "Kindle Internal Storage" device from the Device/Volume area and then click Acquire at the bottom of the window. Set your imaging options and then run the acquisition. Once the imaging is complete (should take only a couple minutes), detach the Kindle device using the Detach option in the ‘File’ menu of MacForensicsLab and then physically detach the device from the forensic workstation.

Examining the contents of the image

Once the device is detached, re-enable Disk Arbitration using the Disk Arbitration… option in the ‘Window’ menu. Next, select Attach Disk Image… from the ‘File’ menu. Select the Kindle image. You may now use MacForensicsLab to examine the contents of the Kindle for items of forensic interest.

Contents of the Amazon Kindle for forensic examination.


Hardware and Software Write Blocking Tips - Hardware and Software Write BlockingWhen creating an image of a suspect drive, the investigator needs to insure that the evidence is not altered and it remains forensically sound. This can be done through the use of a hardware write blocker, software write blocking, or a combination of the two. It is highly recommended that all acquisitions are done using a combination of the two.

If you are using a hardware write blocker attached to your suspect drive to be acquired or examined, remembering to check the jumper settings. In most cases and with most hardware, the jumpers on the drive must be set to Master (consult the drive manufacturer’s website for information on jumper settings for your specific drive model). If the drive does not appear in the device window of MacForensicsLab after a rescan (you can manually rescan the bus by selecting “Rescan” from the File menu), check to make sure that the jumper settings are set to Master on the drive/device.

To enable software write blocking, inside MacForensicsLab turn Disk Arbitration off under the popup menu that appears at the start of the application or you can select Disk Arbitration from the Window menu and disable it there. Disk Arbitration is a background application in Mac OS X that is always running. When Disk Arbitration detects a new storage device it automatically mounts it with write access if available. By disabling it you prevent the suspect drive from being mounted and insure that it cannot be written to. Disk Arbitration will be off until you enabled it again from the Window menu or you reboot.

MacForensicsLab’s Software Write Blocking function will not work on El Capitan and Sierra. If you are running OS X 10.11 or OS X 10.12, please use a hardware write blocker instead.
Posted on

MacForensicsLab Tips and Tutorials – Part One

Tips and Lessons – MacForensicsLab

Part One

Part Two

Part Three

Adding a Case in MacForensicsLab

This lesson demonstrates how to add a case using MacForensicsLab
Open Preferences Window
Open Preferences

Select MacForensicsLab from the Main Window and select Preferences (or from the Main Window use the keyboard shortcut of Command + , ).
Select Cases
Select Cases

Select the Cases Tab from the Preferences Window.
Add a Case
Add a Case

In the lower left corner, select the “+” button to add a new case.
Give the Case a Name
Give the case a name

Delete the default Case ID 1 and give the new case a name (1) , then fill out the Description field (2) to give additional case details.
Complete Case Information
Complete case information

Complete the case information (1 and 2) and then select “Save” (3).
Confirm the New Case was created in the Preferences Pane
Confirm the new case was created in the Preferences pane


Confirm the new case was created by reviewing the Preferences Pane (which automatically displays when you selected Save in the previous step.

Adding a Disk Image in MacForensicsLab

This lesson demonstrates how to add a disk image to a case.
Attach a Disk Image
Attach a disk image


From the Main Window, select “File” (1) and from the drop down list “Attach Disk Image” (2).
Navigate to Disk Image
Navigate to disk image

From the Navigation Window that appears, navigate to and select the desired disk image.
Select Open to Attach the Disk Image
Select Open to attach the disk image

Once you have selected the desired disk image select “Open” to attach the disk image.
Confirm Disk Image has been attached
Confirm Disk Image has been attached

Confirm the disk image has been attached from MacForensicsLab’s Main Window, which appears automatically after selecting the disk image.

Adding Exported Files into a Report in MacForensicsLab

This lesson demonstrates how to add exported files back into the case so they can be bookmarked and added into the report.
Navigate to exported folder containing the exported files
Navigate to the Export folder

Open a navigation window (Finder) and navigate to the location of the exported files folder. In this example, I have Salvaged JPEG files onto the Desktop (1) and (2) into a subfolder named "JPEG" (3).
Open Disk Utility
Open Disk Utility

Open the Disk Utility application located in the Applications -> Utilities folder.
Create a “Disk Image from Folder” using the exported folder
Create Disk Image from Folder using the exported folder
From within Disk Utility select "File" from the Main Window and "New -> Disk Image from Folder" from the drop down list.
Navigate the the Exported Folder
Navigate the the Exported Folder

Navigate to the location where the exported folder is located (1) select it and select "Image" (2).
Name the new disk image
Name the new disk image

Name the new disk image (1), leave all the defaults in place (image format and encryption) (2), then select "Save" (3).
Enter your password
Enter your password

Enter your password to create the disk image.
Quit Disk Utility
Quit Disk Utility

Once the disk image is created (1), quit the Disk Utility application (2).
Navigate to new disk image
Navigate to new disk image

Open a navigation window (Finder) and navigate to the new disk image.
Lock the new disk image
Lock the new disk image

Once you have navigated to the new disk image, use Get Info (command + i) to see the properties (1). From within the Get Info window, select the "Locked" checkbox to lock the image (2), preventing changes to the disk image.
Attach Disk Image to Case
Attach disk image to case

From the MacForensicsLab Main Window, select "File" (1) and "Attach Disk Image …" (2) from the drop down list.
Navigate to the Disk Image
Navigate to the Disk Image

When the navigation box opens, navigate to your newly created and locked disk image (1) and select "Open" (2).
Highlight Volume of new disk image
Highlight Volume of new disk image

From with MacForensicsLab’s Main Window, select the Volume of the new disk image (1), then select the Browse function at the bottom of the Window (2).
Configure the Browse Window
Configure the Browse window

Be sure that only the "Images Only" checkbox is marked (1), then select Browse (2).
Select all Files for Bookmarking
Select all files for bookmarking

Select all the files by highlighting one and selecting (Command + A).
Add Bookmark
Add bookmark

From MacForensicsLab’s Main Window, select "Bookmarks" (1) and "Add Bookmark" from the drop down list (2).
Select Bookmark Folder
Select bookmark folder

Select the appropriate bookmark folder from the drop down list. In this example, I bookmarked all the files into the "suspicious images" bookmark folder.
Create the Bookmark
Create the bookmark

Once the appropriate bookmark folder is selected (1), select "Bookmark" (2).
Open Bookmarks
Open bookmarks

From MacFornensicsLab’s Main Window select "Bookmarks" (1) and "Show All Bookmarks" from the drop down list (2).
Review new bookmarks
Review new bookmarks

Select the appropriate bookmark folder (1) and review the newly created bookmarks (2).
Generate a report
Generate a report

From MacForensicsLab’s Main Window, select "File" (1) and "Write Report" from the drop down list (2).
Select the “Bookmarks” type checkbox
Select the bookmarks type checkbox

Select the Bookmarks type check box (1) to include the new bookmarks in your report, then select: "Start" (2).
Save Report
Save report

Select a location to save your report to (1) and select "Choose" (2).
Review Bookmarks
Review bookmarks

From within the newly created report, review the newly created bookmarks.

Creating a Custom Bookmarks Folder in MacForensicsLab

Open Bookmarks Window
Open Bookmarks window

From MacForensicsLab Main Window select “Bookmarks” (1) and from the drop down list “Show All Bookmarks” (2).
Add a Custom Bookmark Folder
Add custom bookmark folder

To add a custom bookmark folder select the “+” button at the bottom of the screen.
Name the Custom Bookmark Folder
Name the custom bookmark folder

After selecting the “+” button, a text box opens, enabling you to enter a name for the custom bookmark folder.
Add the Name of the Custom Bookmark Folder
Add the name of the custom bookmark folder

Type in the name of the Custom Bookmark Folder and press “Enter.”
Add a description to the Custom Bookmark Folder
Add a description to the custom bookmark folder

With the newly created Custom Bookmark highlighted (1), enter a description of the bookmark folder contents in the text box at the bottom of the screen (2).

Credit Card and Social Security Number Searching Tips - Credit Card and Social Security Number SearchingIdentity theft is a growing issue. With phishing scams and corporate theft, it’s an issue that can affect everyone, even those not online. MacForensicsLab has a built in credit card and social security number (SSN) scanner. This powerful feature allows investigators to zero in on identity theft information. Not only does it search for what appears to be credit card numbers imbedded within files, it also validates them to make sure they are true credit card numbers. No other tool offers this feature.

Credit card number and social security number searching to track down fraud evidence can be done easily with MacForensicsLab

Select the device, folder, or file you’d like to scan and click the “Search” function button. At the bottom of the Search wind at two check boxes. One for Credit Cards and the other for SSN. Check one or both of these and click the "Search" button to scan the selected data. MacForensicsLab will then scan and show you any files containing credit card or social security numbers.

Customize the Report within MacForensicsLab

This lesson will demonstrate how to customize the Report by altering default files and adding files that the examiner wants to be added to every case thereafter.
The MacForensicsLab Templates Folder
MacForensicsLab templates folder

The first time a report is generated using MacForensicsLab, a folder called "MacForensicsLab Templates" folder is created in the same location that the MacForensicsLab application was installed.
The Supplementary Files Folder
Supplementary Files folder

Contained within the MacForensicsLab Template folder is a folder named the Supplementary Files folder. This folder, by default contains three template files; Agency, Investigator and Software Tool. These files are designed to be customized by the user.
Customizing a Default File
Customizing a Default File

To customize a default file located within the Supplementary Files folder, simply double click on the file to open it and make changes to the file, then save your changes. In this example, the "Agency.rtf" file has been customized.
Write a Report
Write a report

To generate a report in MacForensicsLab, select "File" from the Main Window and "Write Report …" from the subsequent drop down list.
Setting up the Report
Setting up the report

A report dialogue box opens and the user selects the items they want to appear in the report by selecting the appropriate checkbox (1) and then select "Start" (2).
Select a Location for the Report
Select a location for the report

Once the "Start" button is selected in the previous step, a navigation window opens, select the location for the report to be written to (1) and select "Choose" (2).
Default Supplementary Files in the Report
Default Supplementary Files in the Report

There are three default files in the Supplementary Files section, which are designed to be customized by the user; these files are: Agentcy.rtf, Investigator.rtf and Software Tool.rtf.
Adding Additional Files to Supplementary Files folder
Adding Additional Files to Supplementary Files folder

In MacForensicsLab you can add as many files as you like to the Supplementary Files folder. These files will remain resident in every case thereafter. This is a great way to reduce the time it takes to continually generate documentation that does not change from case to case. In this example, I would like to add a file called "Glossary of Computer Related Terms" into all of my reports. The first step is to open a navigation window (Finder) and navigate to the desired file.
Add File to Supplementary Files folder
Add File to Supplementary Files folder

Copy or move the desired file into the MacForensicsLab Templates -> Supplementary Files folder.
Generate the New Report
Generate the New Report

Once the report is written it will automatically launch. Observe the new file "Glossary of Computer Related Terms.pdf has been added into the report.
Open new file
Open new file

Select on the hyperlink to the newly copied file to open the file.

Posted on

MacForensicsLab Version History

MacForensicsLab version 4.0

  • Redesigned main window interface.
  • Button panel replaced by the Action menu and context sensitive menus.
  • User can now select which plugins are run by the Audit function.
  • Acquisition information can be added to or deleted.
  • Users can now move bookmarks between folders.
  • Totally revamped search window.
  • Updated device and volume navigation.
  • Better bookmark management.
  • Rewritten backend code for faster functionality.
  • Mac OS X 10.7 Lion compatibility.
  • User addable and creatable audit plugins.
  • Bug fixes.

MacForensicsLab version 3.0

  • Redesigned main window divided into Device and File views.
  • System drive is noted in the shortcuts view in the Files tab.
  • Hash button added to main screen.
  • Analyze hits tracked when viewed.
  • New Analyze window interface. Now defaults to ACSII view and is larger to allow viewing of a block at a time.
  • Ability to highlight data area for carving.
  • Ability to scroll blocks to select areas for carving.
  • New counter reports number of search items found for each keyword within Analyze function.
  • Skin Tone Analyzer now has a sliding bar to dynamically view results of any percentage of Skin Tone on the fly.
  • Browsing search results now allows examiner to apply Skin Tone Analysis to the results.
  • Audit results are now reportable in a separate HTML and/or text document.
  • Audit results can be saved or exported out.
  • Speed improvements with some tasks up to 12 times faster then 2.5.5.
  • Mac OS X 10.6 Snow Leopard compatibility.
  • Resolved all previously known bugs.
  • Redesigned allocation of memory, preventing system freezes due to memory leaks and/or inefficient memory allocation.
  • Now displays system information at the bottom of the main window.
  • “Flying” location bar has been removed.
  • Acquire function window has been redesigned for an easier, more intuitive look and feel.
  • Acquire functions Golden Master option now allows the target save locations to be different for each image.
  • Acquire function now has 64-bit engine.
  • Limit on size and number of keywords has been increased to 128 in the Analyze function.
  • Analyze function is now 64-bit.
  • Attach disk image function now has Shadow File option.
  • Attach disk image function now has Ignore Permissions option.

MacForensicsLab version 2.5.2

  • Mac OS X 10.5 Leopard compatibility.

MacForensicsLab version 2.5

  • Added Microsoft Windows and Linux beta versions.
  • Function buttons laid out in more logical order.
  • Added email alert when operation is complete.
  • Speed increases for processor intensive operations.
  • Increased keyword limits for Search and Analyze functions.
  • More powerful acquisition engine.

MacForensicsLab version 2.0

  • Added Skin Tone analyzer.
  • Added Social Security number and credit card number filtering.
  • Added multi-threaded operations.
  • Added filtering by image size and dimensions.
  • Added ability to create additional file types to salvage.
  • Added pattern matching for hash lists.
  • Added built-in SQL database engine.
  • Added ability to select information included or excluded from a report.
  • Added bookmark manager for adding, deleting, and commenting.
  • Added ability to comment on individual files.

MacForensicsLab version 1.6

  • Added Universal Binary support for Intel and PowerPC Macs.
  • Coding optimizations.
  • Added Audit function.

MacForensicsLab version 1.5

  • Added dual-bootable DVD for Intel and PowerPC based Macs.
  • Added auto report generation function.
  • Added Browse function.
  • Improved bookmark function to allow bookmarking of files across multiple functions.
  • Improved Salvage function to allow resuming of halted salvage process.
  • Streamlined Salvage function.

MacForensicsLab version 1.0

  • Initial release of MacForensicsLab.