Introductory Training Course
This course is designed for forensic professionals with limited experience in Mac forensics. The course will equip students with a basic understanding of Macintosh file structures, imaging procedures and analysis solutions uniquely designed to effectively recover evidence from a Mac drive. Students learn through a combination of course instruction and case studies.
Duration
5 days.
Objectives
Upon completion of this course, you will be able to:
- Identify current Mac hardware and understand relevant forensic concepts as they relate to Mac OS X
- Configure a Mac OS X forensic workstation
- Install and setup forensic software tools used during the forensic analysis
- Utilize important command line tools
- Create and mount Mac forensic images using various methods
- Analyze images using sound forensics principles
- Explore BlackBag and third party forensic tools
- Explain how and when these forensic tools work most efficiently
Audience
This course is intended for law enforcement and corporate forensic professionals with a basic understanding of computer forensics. The class is not designed for computer forensic beginners, as it applies commonly understood forensic practices towards the technical nuances of Mac hardware and software.
Prerequisites
Students without any prior forensic experience should contact BlackBag prior to registration.
Additional Notes
The last day of this course is reserved for certification / discussion and usually ends by noon.
Government employees can use GOV400 coupon code to save $400 off the registration price.
Outline
- Technology Update (OS X & Current Hardware)
- Installing & Using Mac OS X
- Command Line Navigation
- Device Identification
- Imaging
- Mounting
- Analysis
- Practical Application
- Instructor Lead Discussion
- Written and Practical Exam
Course Testimonials
I look forward to taking the other Mac Forensic classes.
Fantastic enjoyable course in a lovely area with great people. All those Mac myths are now understood! Look forward to the next time :)
Great Class! Very knowledgeable instructor (Ryan). Good understanding of Terminal and Command Line = now have more control over my MAC. Thanks!
I bought my first Mac 1 month ago. Even with the little amount of experience coming into the course, I felt comfortable enough at the end to go out and complete an acquisition and examination on an Apple computer.
This is the best course I have taken in a long time. As a Mac newbie, it taught me what I need to know to do a pretty thorough Mac exam.
The class was great. Ryan was extremely helpful not only in our class but he took a look at the brand new Apple equipment that we purchased for our lab and helped up out with any thing we needed. The class was a must for forensic investigators who are not familiar with the Apple product.
Thank you to all, this was a great course.
Having only limited Mac experience, taking the Introduction to Mac Forensics course accelerated my understanding of the Mac computer system. This class also provided me with the tools and knowledge of proper Mac forensics and analysis. Every forensic analyst should include this class in their resume.
The courses and instructors at Blackbag are outstanding. They cover the information needed to be an effective Macintosh examiner. What is covered in the courses can be used when examining a Mac on a Windows system and another Mac. It also makes it quite obvious that if you don't use a Mac to do the examination of suspect Macintosh computer, you will be missing an incredible amount of information. I will returning to take all of their classes.
