As each quarter passes, Apple’s success has been nothing but amazing. In addition to desktop and mobile computers, Apple® produces a variety of unique and innovative devices and applications which can be found in just about every modern home and business. As more and more Apple® devices enter the marketplace exponentially, the need for Macintosh Forensic Training is quite apparent. SUMURI’s five-day Macintosh Forensic Survival Course – Level 2 (MFSC-II) was designed to provide unparalleled instruction in advanced topics relating to the forensic use and analysis of Apple® hardware, technologies and applications.

Click here to find a class now!

As in all of SUMURI’s courses, the training is designed for the participant to learn in a team work environment, and is taught by instructors who maintain a “no one left behind” attitude. In addition, complicated topics are made easy to understand through instructor led exercises and real-life scenarios — supported by a quality student manual to be utilized as a supplemental resource at the completion of the course.

Advanced File System Analysis

Students will be introduced to the concept of domains within the Mac OS X environment and be able to locate evidentiary artifacts. Additionally, students will learn how to manually deconstruct third-party applications.

Advanced Command Line

Underneath Mac OS X’s interface and desktop is the Unix shell, including a Terminal that gives users seemingly endless power and control from the “command-line.” Participants will learn advanced tips using this “command-line” to assist in forensic examinations of a Mac.

AppleScript and Automator

Included with Mac OS X are two applications that allow the user to develop custom applications and workflows to automate almost any task. Participants will learn how to create their own AppleScript and Automator applications to simplify a forensic examination.

Apple Timeline Analysis

Timeline Analysis is one of the most popular investigative trends in Digital Forensics and for good reason. Timeline Analysis can recreate the history of a device’s usage step-by-step and second by second. Learn what Timestamps exist on a Mac, how they can be extracted and how to use the results to enhance your investigation.

Identifying and Using Virtual Machines

Participants will learn how to identify the use of a VM within Mac OS X, and the procedures necessary to analyze them. In addition, the participant will learn how to use a VM to assist in forensic examinations from within the Mac environment.

Mac OS X Server Forensics

Participants will learn about Mac OS X server technology, including services and user accounts. Instruction will be provided on best practices for acquiring data safely from live systems, as well as responding to an incident on compromised systems.

Additional Topics to include but not limited to:

  • iCloud Forensics
  • Unique Apple Technology
  • Advanced Search Techniques
  • Application Deconstruction

Participants will receive:

  • Course Manual
  • PALADIN Forensic Suite

Course Pricing

(Corporate/LE/GOV/EDU)

$2295.00 USD per participant within the US.

Click here to find a class now!