Last year I took IT Forensics FIT5223 which had a strong focus on Windows and at time Linux operating systems.
It was encouraged to learn about what was active on your operating system and how it works through analysis of artefacts.
Through some extra reading around Mac …
The CyberThing Trustmark - a Saturday Arvo project