Course Description

The Apple’s range of Mac computers is no longer restricted to the realm of desktop publishing and computer-aided design. Computer users are attracted by the design of the Mac, its UNIX-like stability, ease-of-use, interoperability with other Apple devices and iCloud storage, and its ability to run other operating systems including Microsoft® Windows. Most die-hard Windows users will refuse to return their Mac once they’ve started using it.

Furthermore, many businesses use Macs as a matter of course, not least of all because of their outstanding security features, which leverage Apple hardware and software working in tandem.

Delivery method: Group-Live. NASBA defined level: advanced

CPE Credits - 32

This hands-on course makes a departure from the world of Microsoft Windows and provides in-depth instruction on analyzing various Mac and macOS artifacts. The course’s topics will cover:

• Mac acquisition methodologies, disk, and partition layout
• HFS+ volume structure, including in-depth analysis of the Catalog and Extents Overflow files and low-level file recovery
• APFS container, volume, and file-system structures, including low-level recovery of data from removable disks
• Fundamental macOS operations, Mac disk and disk-image analysis, and macOS software RAID
• macOS system, user, application, and internet artifacts and acquisition

Course Syllabus

Prerequisites

DF210 - Building an Investigation or EnCE Certification. Advance preparation for this course is not required