[forensics] Analysis & Correlation of Mac Logs

http://computer-forensics.sans.org/summit-archives/2012/analysis-and-correlation-of-macintosh-logs.pdf