Not every investigation involves Windows. Servers, cloud workloads, developer laptops, and many attacker tools run on Linux or macOS, and both leave a different set of traces. Without a registry to lean on, you need to know where these systems keep their configuration, logs, and user activity.
You'll start with Linux file system forensics and the logs under /var/log, then look at shell history files such as .bash_history and what they can and can't tell you. From there you'll see how attackers keep access through persistence mechanisms like scheduled jobs and startup scripts. On the Apple side, you'll cover APFS, property list (plist) files, unified logs, and launch agents.
Next up is Memory Forensics, where you'll move from data stored on disk to what is running in RAM.
An introduction to forensic analysis of the Linux file system, including permissions and where evidence is kept.
A step-by-step beginner's guide to analysing Linux logs during a forensic investigation.
A SANS DFIR Summit talk on the .bash_history file, an important artifact in Linux and Mac forensics, and how it really works.
An overview of macOS forensic analysis, covering hardware-backed encryption, APFS, unified logs, plists, launch agents, and privacy controls.