Page 43 - Master Training Catalog 01222021 stc

P a g e | 43

Macintosh Forensics

The Macintosh forensics class is a 2-week course hosted at the National
Computer Forensics Institute (NCFI) in Hoover, AL. This class will teach
students how to successfully triage, acquire, analyze and report on Apple®
devices using macOS, iOS, and other device specific OSs while also
addressing T2 systems, Filevault2, and APFS encryption functions. The course
progresses from covering topics such as macOS system elements; related file
systems, user and application items, plists, SQLite, along with disk images,
internet, media, device connections, iCloud, iOS, email, and Bootcamp to more
advanced topics in the second week including link files, Time Machine, file
recovery, RAID and Fusion drives, log files analysis, FSevents, Spotlight, and
passwords.

Vendor: Cellebrite (Formerly Blackbag)

Class Size: 24

Offerings: Once a year

Locations: NCFI in Hoover, AL or Onsite as needed

Length of Training: Two (2) weeks