Daily Blog #680: Apple Unified Audit Logging

Hey Reader,
           Today I didn't have the time I needed to get a test kitchen done so I decided to take this opportunity to point you towards another great blog you should be reading with a different focus.

Sarah Edwards over at the Mac4n6 blog has started a series on the apple unified audit logging. If you have not been diving deep in your MacOS/Osx/Whatever they call it now analysis by looking into the data that unified audit logs provide your missing out.

Many examiners look at MacOS as a BSD operating system and just look at syslog, forgetting that there is a whole scaffold of another OS layered on top with its own logging. Apple's Unified Audit Logging is a moving target as they are notoriously not backwards compatible, I mean who else force upgrades file systems?

So do yourself a favor and check out Sarah's blog below:

https://www.mac4n6.com/blog/2020/4/19/introducing-analysis-of-apple-unified-logs-quarantine-edition-entry-0

Also Read: Daily Blog #679

Read More

Daily Blog #662: Forensic Lunch 4/3/20 - Discussion on WinSCP, Linux Forensics Course, SANS DFIR, and More

Hello Reader,
   Today we had another episode of the Forensic Lunch!

On this episode:

• Mari Degrazia (@MariDegrazia) discussing her research into WinSCP and later movement, you can read more here: http://az4n6.blogspot.com/2020/02/detecting-laterial-movment-with-winscp.html
• Hal Pomeranz (@hal_pomeranz) talking about his new Linux Forensics course that you can download here: https://ia801406.us.archive.org/6/items/HalLinuxForensics/HalLinuxForens ics_archive.torrent
• Alex Levinson (@alexlevinson) Gave an update on the National Collegiate Cyber Defense Competition which as gone all virtual this year
• Matt Seyer (forensic_matt) talked about our upcoming SANS DFIR presentation and tools he's working on
• Sarah Edwards (@iamevltwin) gave colorful commentary and meaningful insights 

You can watch the show below:

Also Read: Daily Blog #661

Read More