If someone wants to learn MacOS IR/forensics what’s the best resource for that?

macOS-IR-Forensics.md

• Sarah Edwards (@iamevltwin)

  • mac4n6.com
  • SANS FOR518: Mac and iOS Forensic Analysis and Incident Response
  • Apple Pattern of Life Lazy Output'er

• Unified Log

  • Howard Oakley @howardnoakley
    • Unified log: 1 why, what and how
    • Unified log: 2 content and extraction
    • Unified log: 3 finding your way
    • Full description of the macOS unified log (Paid Paper)
  • Leveraging the Apple Unified Log for Incident Response (CrowdStrike)

• Persistence

  • Beyond good ol' LaunchAgents by Csaba Fitzl
  • KnockKnock
    • Source: https://github.com/objective-see/KnockKnock/tree/main/Plugins

• Endpoint Security Framework (ESF)

  • Apple ESF Event Types
  • Detection Engineering using Apple’s Endpoint Security Framework by Richie Cyrus
  • Taking The macOS Endpoint Security Framework For A Quick Spin by Cedric Owens
  • Objective-See (Patrick Wardle)
    • Process & File Monitor

• Kinga Kieczkowska (@kieczkowska)

  • Notification Center Forensics
  • Air Drop Forensics
    • Part 1
    • Part 2

• Tooling

  • mac_apt - macOS (and iOS) Artifact Parsing Tool by Yogesh Khatri
  • AutoMacTC: Automated Mac Forensic Triage Collector by CrowdStrike

• Books

  • OS X Incident Response Scripting and Analysis by Jaron Bradley

Some blogs for mac forensic artifacts

https://www.swiftforensics.com/search?q=macos

More tools

https://github.com/mnrkbys/macosac

Specific artifact parsers

• https://github.com/ydkhatri/spotlight_parser
• https://github.com/ydkhatri/UnifiedLogReader
• https://github.com/dlcowen/FSEventsParser

APFS 010 Template for research

https://github.com/ydkhatri/APFS_010

UnifiedLog format

https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Spotlight%20store%20database%20file%20format.asciidoc

DSStoreParser (Fixed a bug)
https://github.com/mnrkbys/DSStoreParser/tree/fix_bug_non-ascii

If the Mac computer that you are going to investigate is not shutdown yet, you should collect live information.
TrueTree
https://themittenmac.com/the-truetree-concept/
It can get "true" process tree.