Mac Forensics: Looking Into The Past With Fsevents - Sans Dfir Summit 2017

Mac Forensics: Looking into the Past with FSEvents - SANS DFIR Summit 2017

SANS Digital Forensics and Incident Response

The Cider Press: Extracting Forensic Artifacts from Apple Continuity - SANS DFIR Summit 2017

SANS Digital Forensics and Incident Response

Mac_apt –The Smarter and Faster Approach to macOS Processing - SANS DFIR Summit 2018

SANS Digital Forensics and Incident Response

MAC Times, Mac Times, and More - SANS Digital Forensics & Incident Response Summit 2017

SANS Digital Forensics and Incident Response

What the DLL is happening? A practical approach to identifying SOH -Frank McClain - SANS DFIR Summit

SANS Digital Forensics and Incident Response

The Forensics of Plagiarism: A Case Study in Cheating - SANS DFIR Summit 2017

SANS Digital Forensics and Incident Response

Open-Source DFIR Made Easy: The Setup - SANS Digital Forensics & Incident Response Summit 2017

SANS Digital Forensics and Incident Response

Rob Lee "The Most Lethal Forensicator We Know" Award - SANS DFIR Summit 2017

SANS Digital Forensics and Incident Response

MacOS DS_Stores: Like Shellbags but for Macs - SANS DFIR Summit 2019

SANS Digital Forensics and Incident Response

Digital Forensics Truths That Turn Out To Be Wrong - SANS DFIR Summit 2018

SANS Digital Forensics and Incident Response

Beats & Bytes: Striking the Right Chord in Digital Forensics - SANS DFIR Summit 2017

SANS Digital Forensics and Incident Response