My first post on the SANS forensics blog is up! The post covers a new feature in OSX 10.7 (Lion). Lion saves the location of the windows and other data when the application closes. This additional data can be used to supplient your analysis. Mac is continuing to gain market share and we need to start taking a deeper look into this OS to get the most out of our investigations.
For more information about Mac incident response check out my previous post.
