OS X Investigation and Troubleshooting - Part 3

摘要

Shovels, spades, backhoes, and even your hands: ways to dig. Just like our analog world, OS X provides us many tools with which to dig in. The first two parts of this series introduced several utilities, like tripwire, find and lsbom to check and monitor changes on a file system. We also looked at programs that monitor processes such as top and Spin Control. This month, we'll look at ways to check out specific binaries -particularly ones that are poorly documented. This will take a combination of looking at their images on the file system, and looking at their processes while it's running.