The course
This Mac forensics training course (3 days) gives delegates a practical understanding of:
- Data structures and potential evidence as produced in Apple Mac OS X environments
- Implementing forensic tools on Mac OS X-based file systems
Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Mac Forensics Specialist (CMFS) qualification.
Course Syllabus 
- An introduction to Apple
- Apple Forensic Basics
- Seizure and Imaging – OSX and iOS devices
- Apple Disk Partitioning – APM and GPT
- File systems - compatibility
- A detailed look at HFS+ from a forensic perspective
- System Configuration – e.g. disk formatting, OS installation and networking
- User Accounts – configuration, passwords and file vault
- Files Behind the Scenes – including log files, printing and trash
- Examining iOS - including WebKit and App security
- Common Applications – including Office and Safari
- Time Machine – Functionality and data structures
- Consideration in an Incident Response scenario
Prerequisites
- Principles & general guidelines surrounding forensic investigation
- Basic knowledge of data structures e.g. binary and hexadecimal
 Download
PDF
|
Course outline
Read the CMFS Mac Forensics training course outline to find out more about the many topics covered in CMFS Mac Forensics: Hands-On |
Frequently Asked Questions (FAQ)
