https://www.sentinelone.com/labs/macos-incident-response-part-1-collecting-device-file-system-data/
macOS Incident Response | Part 1: Collecting Device, File & System Data - SentinelLabs
Sep 2, 2021 - How should you investigate an infected Mac? Has there been lateral movement, data exfiltration, system manipulation? Learn macOS incident response here.
device file systemincident responsemacospartcollecting