Mac and Windows Artifacts

  • Sean Morrissey


In this book, we’ve put a lot of emphasis on the iPhone and not a lot on the data that could be left behind on a Mac or Windows computer. Most investigators forget to grab any Mac or Windows computers or to specify within their search warrants that important data is on the desktops; these computers can have historical data and passcodebypass certificates. Not everyone syncs their iPod touch or iPhone as often as in the past, because more and more information is able to be added to these devices without ever syncing with a desktop computer. However, when a new update is released from Apple, Apple has made it necessary to connect to a computer and update the device. During the update process and without user intervention, iTunes automatically creates a backup of the device prior to installing the new firmware. So, both on a Mac and on a Windows computer, there will be historical data left behind.


Virtual Machine Apple Computer Property List Disk Image Window Computer 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Sean Morrissey 2010

Authors and Affiliations

  • Sean Morrissey

There are no affiliations available

Personalised recommendations