Mac Forensics Course

Title: Mac Forensics Course
Year: 2012
Duration: 1 week

Course Aim

The aim of this course is to provide students with general and practical knowledge of Mac OS X forensics at a basic level. Training will encompass latest best practice, technologies and techniques available to Law Enforcement specialists.

Topics include:

  • Hardware and operating system overview
  • File system and partitioning
  • Data acquisition live and post mortem
  • Using a Mac as a forensic platform
  • OS X and applications artefacts


Prior the training the students get provided electronically with preread material which is mandatory to be read and understood. It is mandatory that students have access to a Mac that has Mac OS X Lion in English installed and English keyboard layout.

  • This course is a basic level module and relates to Mac OS X Forensics. The target student group would include any international Law Enforcement Agent involved with computer forensics. The students must have basic knowledge about computer forensics, at least taken the basic forensic course or similar or have been working with computer forensics for at least 1 year.
  • The student must have basic knowledge in command line (UNIX/Linux), a pre read material will be sent out before course begins.
  • The student must have knowledge about computer systems.
  • The student must be able to read, write and understand English.

Small list of agenda / topics / main points

Content includes:

  • Pre read : History of Apple , Hardware overview , Operating system, Unix command line basics
  • Introduction to Mac OS X
  • EFI, Boot Process
  • File System Basics, Permissions, Attributes
  • Post Mortem and Live Data Acquisition
  • Plist and log files, SQLite databases and other artifacts

If you are interested in applying for this course please read following page