During an incident, minutes count. While patterns for investigating Windows hosts quickly are well established the resources for doing the same on Macs are much harder to come by. In this talk we'll cover how to do just that - investigate a Mac quickly and effectively.