When you are on defense and responding to a security incident, your investigation is only as good as the fidelity of the forensic artifacts you collect. As soon as possible, you need to gather as much relevant data from the endpoint, and you need to know where to look. \n\n Introducing Aftermath - A Swift-based, open-source incident response framework. Join us as we demonstrate a real attack using malware that has been found in-the-wild to show how Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. \n\n During analysis, we will timeline the data and show how Aftermath can be used to tell us what actions took place on the system. This will help us uncover the infection vector of the malware. Time is of the essence in an attack, and as macOS becomes more of a lucrative target for attackers, it is important to quickly collect all the relevant data from the endpoint in order to perform a thorough investigation.