U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
first up, slides from @williballenthin (me), @nicastronaut, and @HighViscosity for FireEye Cyber Defense Summit:
"The Unexplored Art of Enterprise macOS Forensics"
http://www.williballenthin.com/presentations/2019-CDS/The%20Unexplored%20Art%20of%20Enterprise%20macOS%20Forensics.pdf …
a cross platform parser for macOS savedState files. you can use this to, e.g., recover shell history despite anti-forensic measures. also, other applications, too.https://gist.github.com/williballenthin/994db929b1448fdf73baf91207129dec …
a cross platform parser for macOS keychain databases. i know, i know, there is http://chainbreaker.py . this one has maybe more (or less) features ;-)https://gist.github.com/williballenthin/d6bf9f1553d9fa27e0cc6880a6d992b4 …
a cross platform parser for macOS stickies databases. this file format took a while to really understand. output is usually RTF and image data.https://gist.github.com/williballenthin/600a3898f43b7ad3f8aa4a5f4156941d …
last, BUT NOT LEAST, is ARDvark, a cross platform parser for Apple Remote Desktop artifacts, mostly by @nicastronaut.
recovers program execution, logins, file system contents, and more for very long periods of time.https://github.com/fireeye/ARDvark
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
