Mac OS X, Mac Security Mac OS X: Forensics November 20, 2006 It’s old but it’s good: http://www.afp548.com/Articles/security/postmortem.html
