Can you get malware in PDF? How far can you trust a PDF, or could it be a forgery? How to sign PDFs, and what data may remain hidden inside them.
forensics
It’s all too easy to change the information in a Finder Alias when you’re inspecting it. Here’s how to avoid that, and a new version of Precize to help.
Diagram summarising how Finder Aliases work, including their resolution. And how to confuse QuickLook thumbnails.
Finder Aliases can update their path information when they are resolved. Also some differences between Aliases and Bookmarks.
Details of some of the information stored inside Bookmarks and Finder aliases, and a new version of Precize to show you that info.
I am delighted to announced that my paper providing the first full description of the macOS unified log […]
Even a lean and simple High Sierra system has many xattrs of many types, and plenty of files still have ‘resource forks’. Plus details of some important xattrs used by Apple’s system files.
They’re almost invisible, but surprisingly widely used. xattrs come in very many different types, and contain valuable information. Here are results from analysing most of a Sierra startup volume.
A new tool for performing full analysis of metadata for an APFS volume is now available – on an early bird offer.
Did you know your Mac may keep a history of its activities going back for over 3 months? Here’s how to access it, and some surprising results.
The Eclectic Light Company 