Spotlight: Your Forensic Goldmine in iOS & macOS

Spotlight is the default indexing engine on iOS™ and macOS®. It is ON by default and stores information about almost every file and folder on the file system. This information includes hundreds of different types of metadata from file-paths and MAC timestamps to document titles, authors, dates viewed and image/video exif tag information. It is not limited to files; emails, notes, text messages, and internet history are all found here. We will explore how to exploit this information with freeware tools we developed and explain how best to interact with and interpret this data.

Presented by:
Yogesh Khatri, Associate Professor & Program Director (Digital Forensics), Champlain College

NW3C does not share webinar attendees’ personally identifiable information with any third party without opt-in consent given during registration.

The views and opinions expressed in this presentation are those of the individual presenters and do not represent official policy, position, opinions, or views of NW3C.