Sarah Edwards (@iamevltwin) mac4n6.com SANS FOR518: Mac and iOS Forensic Analysis and Incident Response Apple Pattern of Life Lazy Output'er Unified Log Howard Oakley @howardnoakley Unified log: 1 why, what and how Unified log: 2 content and extraction Unified log: 3 finding your way