When processing an investigation of a suspect's Mac OS X hard drive using MacForensicsLab there are several places that you may want to start your search. These folders are present on all versions of Mac OS X and contain a great deal of information that will help the investigator to show intent and may also give them a better idea of where they should look next.
A good place to start forensic discovery on any Mac OS X machine is inside the ~Users/"USERNAME"/ folder. Within this folder you can find sub-folders containing large amounts of user data. Many peer-to-peer applications create folders here and many times there are other user-created folders found here.
The ~/Users/"USERNAME"/Library folder and it's sub-folders have a vast amount of usable forensic material. Some sub-folders of interest in here are; Caches, Calendars, Cookies, Keychains, Logs, Mail, Preferences, Recent Servers, and Safari. Any of these can be examined with MacForensicsLab's Analyze function or the Salvage function depending on the kind of data discovery you are after.
The ~/Users/"USERNAME"/Documents is the default save-to folder for many applications and many users use this folder to store everything from text documents to pictures and movies.
The ~/Users/"USERNAME"/Pictures folder if the default storage location for Apple's iPhoto. Photos loaded into iPhoto are stored here in the iPhoto Library folder in iPhoto version before '08. In iPhoto '08 the iPhoto Library folder is replaced by a package with the same title. Many users use this folder to store images from other applications also.
The ~/Users/"USERNAME"/Movies folder is the default storage location for many video editing applications including Apple's iMovie. Many users use this folder to store video files on their system.
