-
735 items
1 item
211 item
238 item
169 item
88 item
13 item
9 item
10 item - For developers
This script parses Apple System Log (ASL) files from MacOS. These files are typically located at the following path:
Regardless of user selection, the script will only parse files that have an 'ASL DB' file signature.
In addition to targeting specific files, the script can be instructed to output only those records that originate from the com.apple.system.utmpx or com.apple.system.utmpx facilities.
Notwithstanding the prevalence of unified logging on MacOS, these records still log system boots/reboots, system shutdowns, user logins/logouts, and terminal session logins/logouts. They are read by the last command albeit incompletely.
It is worthy of note that shutdowns won't always be logged; It's not known why.
Output is by way of a tab-delimited spreadsheet file and (optionally) bookmarks. The latter may take some time to create, so the examiner is advised to monitor progress through use of the console window.
It should be noted that an ASL record may point to string data located elsewhere in the file. Whilst this data will be presented as part of the record, it won't be bookmarked. This is likely to lead to gaps between the bookmarks created by the script.
This script was developed for use in EnCase training. For more details, please click the following link:
Tested with: EnCase Forensic 25.1
Please upgrade to one of the following broswers: Internet Explorer 11 (or greater) or the latest version of Chrome or Firefox
