Avoiding the “Gotchas” while Triaging and Imaging a Mac

*This is a recorded session from the 2020 National Cyber Crime Conference**

In this session, Bruce will take you through to dos, don’ts and gotchas when triaging and imaging Mac computers. What can you touch, where can you get information on a live running Mac, how can you triage a Mac live to find specific data? These are all questions that examiners are often presented with when confronted with a Mac computer. Then once you get past triaging the Mac, how do you image it? What about T2 encryption – how does that affect the data you can get and can’t get?