Macintosh Forensics


  • Apple Hardware and Tech
  • Introduction to the macOS and the Desktop
  • Understanding CoreStorage, Fusion, FileVault and APFS
  • Imaging Mac RAM
  • Understanding the Mac File System
  • Mac Security Issues and Encryption
  • Password Recovery
  • Building a Mac Forensic Workstation
  • Macintosh Search and Seizure
  • Safely Obtaining System Information
  • Firmware Passwords
  • Volatile Data Collection
  • Manual and Automated Imaging and Acquisition
  • Verifying and Safely Mounting Forensic Images
  • Indexing Forensic Images
  • Search Techniques Using macOS
  • Locating Evidence (Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs and more)
  • Recovering Deleted Files
  • Examining SQLite Databases and PLIST files
  • Using macOS for Forensics
  • Reporting
  • Review of Recommended Applications
  • Review of Automated Forensic Tools
  • Recommended Macintosh Hardware Requirements for Forensics and much more!

Advanced Macintosh forensics:

Advanced Command Line

Underneath Mac OS X's interface and desktop is the Unix shell, including a Terminal that gives users seemingly endless power and control from the "command-line." Participants will learn advanced tips using this "command-line" to assist in forensic examinations of a Mac.

Advanced File System Analysis

Students will be introduced to the concept of domains within the Mac OS X environment and be able to locate evidentiary artifacts. Additionally, students will learn how to manually deconstruct third-party applications.

AppleScript and Automator

Included with Mac OS X are two applications that allow the user to develop custom applications and workflows to automate almost any task. Participants will learn how to create their own AppleScript and Automator applications to simplify a forensic examination.

Identifying and Using Virtual Machines

Participants will learn how to identify the use of a VM within Mac OS X, and the procedures necessary to analyze them. In addition, the participant will learn how to use a VM to assist in forensic examinations from within the Mac environment.

Apple Timeline Analysis

Timeline Analysis is one of the most popular investigative trends in Digital Forensics and for good reason. Timeline Analysis can recreate the history of a device's usage step-by-step and second by second. Learn what Timestamps exist on a Mac, how they can be extracted and how to use the results to enhance your investigation.

Mac OS X Server Forensics

Participants will learn about Mac OS X server technology, including services and user accounts. Instruction will be provided on best practices for acquiring data safely from live systems, as well as responding to an incident on compromised systems.

Mac OS X Server Forensics

  • iCloud Forensics
  • Unique Apple Technology
  • Advanced Search Techniques
  • Application Deconstruction

Images add an artistic touch to your blog posts and will help draw in your readers. The first image from your content will automatically be used as the thumbnail for the blog post. The perfect opening image can increase the attractiveness of your article.

The introductory paragraph gives readers the main idea of what to expect. It can also be used as a short preview in the blog post list. Different formatting will help it stand out from the rest of the texts. Read further to see how can you format your blog posts.

Short and simple blog posts are the best way to keep your visitors in the loop. An exciting introductory paragraph and brief, informative content will ensure that your readers will keep coming back.

Russian Federation, somewhere in Moscow
Powered by Webnode
Create your website for free! This website was made with Webnode. Create your own for free today! Get started