Question

Determine whether or not you believe the forensic processes taken by an investigator on a Macintosh system is different from that on a Windows or Linux system. Determine which type of system you would prefer to utilize if you were leading an investigation. Additionally, decide whether or not the specifics of the investigation would have a determination on your choice and why or why not.

Answer 1

Yes, forensic processes taken by an investigator on a Macintosh system is different from that on a Windows or Linux system.

I would prefer to utilize Macintosh system if I would be leading an investigation because in investigation main criteria is security of files and Macintosh is preferred as it provides better security by the following features:-

• One must know where file system components are located and how both files and file components are stored.So,it difficult for unknown person to use it.
• Apllication settings are in there formats : plaintext,plist files and SQLite database. But, the main thing is the plist files which can only be used by special editors .So,through internet hacking; files are not exposed.
• Mac provides a FileVault which encrypts the whole disk with 128-bit AES encrytpion
• Mac can use keychains to manage passswords for application,web sites and other system files
• Unlike windows, Max files retain their filenames in the trash.In additon to that, when we copy a file the creation time is also copied so MAc timestamps are more accurate whereas windows timestamps get reset after copying
• Mac have limited access to other user accounts and guest account is disabled by default
• And, many programmers use Windows and windows applications don't support Macintosh.So, less chance of softwares for hacking.