Mac Forensics Course

Title: Mac Forensics Course
Duration: 1 week

Course Aim

The aim of this course is to provide students with general and practical knowledge of Mac OS X forensics at a basic level. Training will encompass latest best practice, technologies and techniques available to Law Enforcement Specialists.

Topics include:

  • Hardware and operating system overview
  • File system and partitioning
  • Data acquisition live and post mortem
  • Using a Mac as a forensic platform
  • OS X and applications artefacts


Prior to the training, the students get provided electronically with preread material which is mandatory to be read and understood. It is mandatory that students have access to a Mac that has Mac OS X Lion in English installed.

  • This course is a basic level module and relates to Mac OS X Forensics. The target student group would include any international Law Enforcement Agent involved with computer forensics. The students must have basic knowledge about computer forensics, at least taken the basic forensic course or similar or have been working with computer forensics for at least 1 year.
  • The student must have basic knowledge in the command line (UNIX/Linux), a pre-read material will be sent out before the course begins.
  • The student must have knowledge of computer systems.
  • The student must be able to read, write and understand English.

Small list of agenda / topics / main points

Content includes:

  • Pre-read : History of Apple, Hardware overview, Operating system, Unix command line basics
  • Introduction to Mac OS X
  • EFI, Boot Process
  • File System Basics, Permissions, Attributes
  • Post-Mortem and Live Data Acquisition
  • Plist and log files, SQLite databases and other artefacts

If you are interested in applying for this course please read the following page