Title: Mac Forensics Course
Duration: 1 week
Course Aim
The aim of this course is to provide students with general and practical knowledge of Mac OS X forensics at a basic level. Training will encompass latest best practice, technologies and techniques available to Law Enforcement Specialists.
Topics include:
- Hardware and operating system overview
- File system and partitioning
- Data acquisition live and post mortem
- Using a Mac as a forensic platform
- OS X and applications artefacts
Prerequisites
Prior to the training, the students get provided electronically with preread material which is mandatory to be read and understood. It is mandatory that students have access to a Mac that has Mac OS X Lion in English installed.
- This course is a basic level module and relates to Mac OS X Forensics. The target student group would include any international Law Enforcement Agent involved with computer forensics. The students must have basic knowledge about computer forensics, at least taken the basic forensic course or similar or have been working with computer forensics for at least 1 year.
- The student must have basic knowledge in the command line (UNIX/Linux), a pre-read material will be sent out before the course begins.
- The student must have knowledge of computer systems.
- The student must be able to read, write and understand English.
Small list of agenda / topics / main points
Content includes:
- Pre-read : History of Apple, Hardware overview, Operating system, Unix command line basics
- Introduction to Mac OS X
- EFI, Boot Process
- File System Basics, Permissions, Attributes
- Post-Mortem and Live Data Acquisition
- Plist and log files, SQLite databases and other artefacts
If you are interested in applying for this course please read the following page