Digital Evidence and Computer Crime, Second Edition

12.6 Summary

Despite their friendly appearance, Macintosh systems are quite complex and powerful. Recovering deleted files manually is a difficult task because of the intricate structure of the Catalog file. Existing tools can be used to perform basic digital evidence examinations of Macintosh systems, including the viewing file structure and recovering deleted data. However, there is a dearth of tools for interpreting special files such as "Desktop DB" and "cache.wav." There is a need for more digital evidence examination tools and research for Macintosh systems. As on other systems, Internet applications on Macintosh systems can keep records of activities. With the emergence of MacOS X and ".Mac," these systems contain more network-related data.