In these increasingly connected times, most computers are connected to some sort of network. The information about current network connections can help direct an investigation or show examiners new areas that may be of interest to the investigation. Using a triage tool like MacLockPick II can show an examiner a suspects ARP tables, open interfaces, and netstat activity.
