will finish later

Forensics/README.md

@@ -2,6 +2,52 @@
 
 ## Disk Forensics
 
+### Basic useful CLI tools:
+
+#### ps
+Show the processes for all users (a), displaying the process's user/ownser (u), and the processes that are not attached to a terminal (x):
+
+```shell
+$ ps aux
+```
+
+Display the full listing of all processes (useful for finding underisable processes):
+
+```shell
+$ ps ef
+```
+
+#### lsof
+
+Display a specific pricess in more details, by displaying the files and ports associated with that process.
+```shell
+$ lsof -p
+```
+
+Display processes running form or acessing files that have been unlinked: 
+
+```shell
+$ lsof +L1
+```
+
+#### find
+
+```shell
+$ find / -uid 0
+```
+
+### arp
+
+Display all MAC to IP address mapping of the system (useful for finding addresses of systems that are not part of the network.
+
+```shell
+$ arp -a
+```
+
+
+Others: uptime, free, df.
+
+
 ### dd
 
 ### strings
@@ -11,6 +57,8 @@ $ strings /tmp/mem.dump | grep BOOT_
 $ BOOT_IMAGE=/vmlinuz-3.5.0-23-generic
 ```
 
+
+
 ### scalpel
 
 ### TrID
@@ -21,8 +69,6 @@ $ BOOT_IMAGE=/vmlinuz-3.5.0-23-generic
 
 ### ExifTool
 
-### Hex editors
-
 ### dff
 
 ### CAINE
@@ -40,11 +86,13 @@ $ BOOT_IMAGE=/vmlinuz-3.5.0-23-generic
 
 ### Volatility: Analysing Dumps
 
-* [I have a lot of material on Volatility and Memory Forensics here](volatility.md)
-* I highly reccomend their training.
+* [Lots of material on Volatility and Memory Forensics here](volatility.md)
+* [On OSX Memory Forensics](osx_memory_forensics.md)
+* I highly recommend their training.
+
 
 ---------------
-### Scripts
+## Scripts
 
 #### PDFs
 Tools to test a PDF file:

Forensics/osx_memory_forensics.md

@@ -0,0 +1,3 @@
+# OSX Forensics
+
+(tbw)