±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 5 Overall: 36758
New Yesterday: 4 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 77 matches

Re: Mac OS Remote Forensic Collection

Post Posted: Mar 20, 20 10:33

Hi,

EnCase 8.11 has an agent that currently supports macOS Catalina 10.15 remote preview and acquisition, with the T2 support coming in a later release.

Regards
hommy0
Topic: Mac OS Remote Forensic Collection
Replies: 6
Views: 1665
 

Re: Mac OS Remote Forensic Collection

Post Posted: Mar 18, 20 19:41

Hi,

EnCase in an upcoming release should have the remote agent that supports the T2 chip. It was demonstrated by Simon Key at EnFuse last November. The agent will also work with macOS 10.15 Catal ...
hommy0
Topic: Mac OS Remote Forensic Collection
Replies: 6
Views: 1665
 

Re: EnCase 8 and generating a file attributes report

Post Posted: Feb 11, 20 21:47

Hi,

If you select the entries of interest you should be able you export file details using the application menu (aka hamburger) on the side of the table.

From there you can create an export (TSV ...
hommy0
Topic: EnCase 8 and generating a file attributes report
Replies: 2
Views: 670
 

Re: apple macBook ip address

Post Posted: Feb 04, 20 09:22

Hi,

Try the following: /private/var/db/dhcpclient/leases

Regards
hommy0
Topic: apple macBook ip address
Replies: 3
Views: 788
 

Re: WebCacheV01.dat - opened files with Windows Explorer?

Post Posted: Jan 17, 20 10:40

Hi

To re-iterate other posters, I would test this for yourself with the options you mention (File Explorer double click and right click Open With)

A tool such as ESEDatabaseViewer from Nirsoft ...
hommy0
Topic: WebCacheV01.dat - opened files with Windows Explorer?
Replies: 5
Views: 2029
 

Re: AD Enterprise versus Endpoint Investigator

Post Posted: Jan 17, 20 10:03

Hi,

Can you confirm what you mean by [i]"Endpoint Investigator (and won't support macOS Catalina 10.15)"[/I]

If you are talking about Agent deployment and running on the Mac endpoint for remote ...
hommy0
Topic: AD Enterprise versus Endpoint Investigator
Replies: 5
Views: 2008
 

Re: imaging using encase, FTK and X-ways

Post Posted: Dec 13, 19 11:57

There is only a Windows version of EnCase.
It is has the ability and functionality to parse multiple file systems (other than NTFS, FAT, ExFAT) including EXT2,3, and 4
If you have taken a DD image y ...
hommy0
Topic: imaging using encase, FTK and X-ways
Replies: 8
Views: 3531
 
Page 1 of 11
Page 1, 2, 3 ... 9, 10, 11  Next