We offer a one-day training course on Mac OS X forensics and Mac Marshal. The course includes:

• Overview of Mac OS X, including virtual machine and dual-boot operation of Macs
• Review of Mac disk formats and the HFS+ file system
• Discussion of FileVault home directory encryption
• Usage of Spotlight to perform rapid searches of forensic data
• Detailed descriptions of common application data/cache formats on OS X
• Analysis of forensic data written by the OS and programs such as Safari, Address Book & Mail
• Hands-on exercises using Mac Marshal
• Certification

Through hands-on training, students will learn to:

• Analyze Mac OS X and dual-boot disk images
• Analyze configuration and log files from common OS X applications, such as Mail, Safari, iChat, and Address Book
• Perform rapid searches using Spotlight metadata
• Gather comprehensive machine usage info
• List detailed information about every iPod and iPhone that has been connected to the machine
• Detect and extract VMWare, Parallels, and Virtual Box virtual machine images
• Detect and analyze FileVault-encrypted user directories
• Maintain an audit trail and generate detailed reports in RTF, PDF, and HTML formats

Training Schedule

Please contact our Training Coordinator for more information.

• May 24, 2013 - Lake Charles, LA

To register for one of the training classes listed above, please contact our Training Coordinator with the following information:

• Your name
• U.S. Law Enforcement agency name
• Work address
• E-mail address
• Work Phone number
• Class date and location you are interested in