\n
![](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1715044267493-KWVM4672BKFRZ7Z69QBR\/whatyear.gif?format=1500w\")
<\/p>\n
\n<\/p>\n
Hello folks, I\u2019m back! I took a bit of a break because burn out is no joke \u2013 seriously\u2026take care of yourselves! I\u2019ve been on what I\u2019m calling a mid-career retirement \u2013 travelling the world to make up for lost pandemic travels.<\/p>\n
I\u2019ve been working on a few projects, most recently (and the purpose for this update) I have updated one of my favorite scripts, FSEventsParser from Nicole Ibrahim. I\u2019ve updated it to python 3 and updated for the latest version that came out in macOS 14, version 3 (SLD3 header).<\/p>\n
FSEvents are one of my favorite forensic artifacts, if you aren\u2019t parsing them out you are absolutely missing fantastic file system related information. Files Created! Files Deleted! And so much more! You can get my version of the script here*: https:\/\/github.com\/mac4n6\/FSEventsParser<\/span><\/a><\/p>\n *Cavet: The new format has a new field; I have not yet dived into what it is used for.<\/p>\n This script came about because I\u2019ve given my class a massive update. If you haven\u2019t taken SANS FOR518<\/a> ever (or for a while), now is a great time to do so! There is a whole new dataset with the latest and greatest OS\u2019s which also means an all new workbook with 23(!) new labs!<\/p>\n I\u2019ve added a ton of new material and am super excited to introduce Corellium<\/a> into the course in a new forensic testing module. If you\u2019ve been around this blog for a bit, you know I\u2019m a big proponent of testing EVERYTHING!<\/p>\n We also have a new CTF-style challenge thanks to Kat Hedley<\/a> and I\u2019ve been doing a demo of the Apple Vision Pros with live forensics!<\/p>\n \u00a0<\/p>\n Lee<\/a> and I have classes coming up<\/a>!<\/p>\n San Diego (In-Person and Online – This week, starts Thursday May 9!)<\/p>\n<\/li>\n US DFIR Summit in August (Online Only)<\/p>\n<\/li>\n APAC DFIR Summit \u201cin\u201d Tokyo in September with Japanese Translation (Online Only)<\/p>\n<\/li>\n Europe DFIR Summit in October in Prague, CZ (In-Person and Online)<\/p>\n<\/li>\n DFIRCon in November (Online Only)<\/p>\n<\/li>\n In December Online \u201cin\u201d Tokyo with Japanese Translation (Online Only)<\/p>\n<\/li>\n The new On Demand version of the course has also just dropped! Take it whenever you like!<\/p>\n<\/li>\n<\/ul>\n \u00a0<\/p>\n Don\u2019t forget this class has a GIAC cert now, the GIAC iOS and macOS Examiner (GIME)<\/a>. <\/p>\n I hope this is the first of a new generation of blogs that I release. I\u2019ve got a few good ideas that I\u2019d love to research and write about but I will also be taking it relatively easy so as to not burn out again.<\/p>\n<\/div>\n\n