This training is intended for U.S. Criminal Justice
Practitioners. Please register using your agency-issued email.
This course teaches students to identify and collect
volatile data, acquire forensically-sound images of Macintosh®
computers, and perform forensic analysis of macOS®
operating system and application artifacts. Students gain hands-on
experience scripting and using automated tools to conduct a simulated live
triage, and using multiple methods to acquire forensically-sound images of
Macintosh computers. Topics include how the macOS default file system stores
data, what happens when files are sent to the macOS Trash, where operating
system and application artifacts are stored, and how they can be analyzed.
Forensic artifacts covered include password recovery, recently opened files and
applications, encryption handling, Mail, Safari®, Messages,
Facetime®, Photos, Chrome™, and
covered in this course include:
• Performing live triage
• Macintosh imaging
This is an advanced course, intended for
digital forensic examiners who have experience working with macOS, and
experience preserving and collecting data of evidentiary value.
NW3C recommends that students complete the following courses before
registering for Advanced Digital Forensic Analysis: macOS:
All classes are subject to
cancellation up to 45 days before the start of class if the minimum class
registration threshold is not met.