macOS Forensics: Artefacts

Walkthrough summary

macOS Forensics: Artefacts TryHackMe walkthrough with 17 answered prompts and lab methodology notes.

Sample prompts covered

• What command can be used to mount the image named mac-disk.img to the directory ~/mac in the attached VM, making sure the Data volume is mounted?
  Open the walkthrough page to inspect the full answer and command flow.
• In the attached VM, which utility can we use to parse plist files?
  Open the walkthrough page to inspect the full answer and command flow.
• When was the OS installed on the disk image present in the attached VM? Write your answer as GMT in the format: YYYY-MM-DD hh:mm:ss
  Open the walkthrough page to inspect the full answer and command flow.
• What is the country code for this machine?
  Open the walkthrough page to inspect the full answer and command flow.
• When was the last time this machine booted up? Write your answer as GMT in the format: YYYY-MM-DD hh:mm:ss
  Open the walkthrough page to inspect the full answer and command flow.