← incident responder

Linux & macOS Forensics — Logs, Persistence, and Artifact Locations

intermediate 4h

Investigate Linux and macOS endpoints — key log locations, persistence mechanisms, artifact collection, and the forensic differences from Windows that trip up Windows-centric responders.

Lessons

1 Linux Log Locations — Where Evidence Lives on Linux Systems
20 min
2 Linux Persistence Mechanisms — Where Attackers Hide on Linux
25 min
3 Linux Artifact Collection — Triage Methodology and osquery
20 min
4 macOS Forensic Artifacts — Unified Log, FSEvents, TCC, and Quarantine
25 min
5 macOS Persistence, Triage Collection, and Container Forensics
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →