Sarah, a forensic investigator, is conducting an investigation on a macOS device that is suspected to have been compromised. She is tasked with gathering evidence of unauthorized access to the system. As part of her investigation, she needs to locate information related to when and who accessed the system. In addition to reviewing general system logs. Sarah knows she must focus on certain types of system files that might provide detailed data on unauthorized activities. Which area of the macOS file system would provide the most relevant information regarding logon attempts and other authentication events?
Submit