Get more info about OS X Syslog Forensics

Let’s talk about the survival digital forensic series. This week’s episode of the Digital Forensics Survival podcast covers the OS X Syslog. For this Michael recommends using the inbuilt OS X console application.

 
A logfile is a file that records either events that occur in an operating system or other software runs, or messages between different users of a communication software. Logging is the act of keeping a log. In the simplest case, messages are written to a single logfile.

 
The one good thing about this application is it’s going to give some inside into all the log files on your forensic mac. Look through those log files and you’ll be amazed at how many there actually are: you’ll find system log files, some user log files, as well as many application log files and then of course is a number of log files with it in each category and depending on the version you’re dealing with, different things maybe logged here.

 
The console application is good because what we can do with it is on your forensic mac, you can bring the console off and you can then look at the log file on your own system and do some of a file experimentation. If you are going to be looking for specific activity on a mac log file that is actually evidence so, it’s an easy way to do some validation tests because you’ll immediately see the results.

Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a step-by-step process that should be followed when an incident occurs.

More