Artifacts

Posts Tagged ‘memory’


Mac OS X Sleep/Hibernate and Swap Image File

Posted by:  /  Tags: , , ,

Author
Pasquale Stirparo, @pstirparo
Artifact Description
Contents of RAM are written into the sleepimage file when the computer is put to sleep.
Numerous swap files may be found in the /var/vm/ directory with the naming convention of swapfile# (swapfile0, swapfile1, swapfile2, etc.)
File Locations
/var/vm/sleepimage
/var/vm/swapfile#
Research Links
https://github.com/pstirparo/mac4n6

http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location

https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=4
Any Other Information
These artefacts are collected under the ma4n6 project, aiming at being single point of collection for OSX artifacts from where such locations are later shared via:
– yaml library
– ForensicsWiki.org
– ForensicsArtifacts.com
So that the effort is made only once, and the output reused everywhere.