In FTK Imager click: File > Evidence Item> Image Fileģ. Otherwise, open FTK Imager and follow these instructions:ġ.ĝownload the folder Mac_OS_X4_Tiger. Please feel free to look around and familiarize yourself with the data structures.ĮXERCISE #1: You may use your own forensic tools if you like. The purpose of this exercise is to allow you the opportunity to see the structure of the filing system as compared to that of Windows.
One is from version 10.4 “Tiger” and the other is from a more contemporary 10.9 “Mavericks”. We are going to look at two Mac OS X images.
0 kommentar(er)
