2012-08-01 [forensics] Analysis & Correlation of Mac Logs sec http://computer-forensics.sans.org/summit-archives/2012/analysis-and-correlation-of-macintosh-logs.pdf