OS X Incident Response: Scripting and Analysis
Jaron Bradley · Syngress (Elsevier) · First edition · 2016
Identifier: ISBN 978-0-12-804456-8
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Live response and postmortem analysis on macOS using bash and Python tooling the reader writes: startup and persistence mechanisms, scheduling, browser history, memory analysis, credential extraction, exfiltration detection and timelining.
Who it is for, and when
Still the clearest book-length account of what to collect from a running Mac and in what order, and of the persistence surface an intruder can use. The habit it teaches — write the collection script, know what each command touches — is what makes a macOS live response defensible.
What it does not cover
HFS+-centric and published a year before APFS shipped. It predates System Integrity Protection hardening, TCC, notarisation, Apple Silicon and the Endpoint Security Framework, so the artifact paths and file system chapters are unreliable on any current Mac.
Go to the source
Open at shop.elsevier.com (opens in a new tab)https://shop.elsevier.com/books/os-x-incident-response/bradley/978-0-12-804456-8
Details
- Type
- Book
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Jaron Bradley
- Publisher
- Syngress (Elsevier)
- Version verified
- First edition
- Year
- 2016
- Identifier
- ISBN 978-0-12-804456-8
- Topics
- macos, incident-response, triage, scripting, timeline
- Checked at source
Related entries
A community-maintained, machine-readable knowledge base of digital forensic artefact definitions — where an artefact lives and how to collect it — expressed in YAML and licensed Apache-2.0. It is documented at artifacts.readthedocs.io and coordinated through the forensicartifacts Google Group and the Open Source DFIR Slack.
Velociraptor
FreeAn open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a fleet of agents. Development is sponsored by Rapid7, with the code still published under the Velocidex organisation.
Antisyphon Pay What You Can Training
Partly freeAntisyphon runs selected courses on a Pay What You Can model, stating that it wants to help people who cannot afford conventional training prices. Courses confirmed on the page at the time of checking are SOC Core Skills in the Age of AI with John Strand (live and on-demand) and the Professionally Evil CISSP Mentorship Program (live, multiple instructors).
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.