1. Chapter 19 ©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. Forensic Examination of Macintosh Systems

2. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 19.1 (A) File record interpreted using Norton Disk Editor. (B) Same file record in hexadecimal form.

3. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 19.2 HFS viewed in EnCase showing Catalog file record from Figure 19.1.

4. Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 19.3 Norton Unerase.

5. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 19.4 IE Cache.waf file viewed using WAFInspec.

6. Figure 1.1 Copyright © 2011 Academic Press Inc.©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved. FIGURE 19.5 Entries in a keychain database from Mac OS X system.