Some good things to have on hand for your macOS investigatons MacOS File System Artifacts and Files OSX Incident Response Scripts from ‘OS X Incident Response Scripting and Analysis by Jason Bradley’ Property Lists & Launch Agents Startup System & Scheduling Browser Analysis