Twitter Linked In

Macintosh Forensics
Sorry there are currently no sessions scheduled for Macintosh Forensics.
Please let us know you are interested in this course.

Fulcrum Training Vendors
Macintosh Forensics

This advanced AccessData® training course provides the knowledge and skills necessary to recover and analyze forensic artifacts from the Macintosh operating system using Forensic Toolkit® (FTK®), FTK Imager, and Password Recovery Toolkit® (PRTK®). Participants will learn GPT drive structure and sound methodology for imaging Macintosh hard drives as well as how to obtain date and time information from Macintosh systems. In addition to working with the Macintosh operating system, participants will recover artifacts from Macintosh- associated programs such as Safari and Firefox browsers, iChat, and Apple Mail. Participants will also learn how to recover artifacts from iPod and iPhone devices. 


This hands-on course is intended for forensic investigators with experience in forensic case work and a basic working knowledge of FTK, FTK Imager and PRTK.

To obtain the maximum benefit from this course, you should meet the following requirements:

Able to understand course curriculum presented in English
Attend the AccessData Forensic BootCamp or have equivalent experience with FTK and PRTK Have previous investigative experience in forensic case work
Be familiar with the Microsoft Windows environment

Class Materials and Software:

You will receive the associated materials prior to the course.

During this three-day, hands-on course, participants will perform the following tasks:

• Use FTK and FTK Imager to examine HFS drive structure
• Image, examine, and report on Macintosh evidence
• Examine Property Lists and the SQLite databases on Macintosh systems to recover the same evidence found in Index.dat files, the registry, and link files on Windows systems
• Obtain date and time information from Macintosh systems
• Defeat the File Vault
• Use FTK and PRTK to recover the user logon password
• Recover artifacts from the Safari and Firefox browsers including cookies, download path entries, form data, browser history, cache files, bookmarks, chat files, and sign-on passwords
• Recover iChat artifacts including AIM user names, user icons, user account information, saved transcripts, and download files
• Navigate the Apple Mail directory structure to review user mailboxes, email messages, and attachments
• Recover iPod artifacts including photos, contacts, and calendars
• Recover iPhone artifacts including address book and calendar information, call history, text messages, photos, and voicemail 

Macintosh Forensics
Sorry - there are no sessions available to book.
Contact us
Australia:+61 (0)2 8012 9810
Singapore:+65 9297 1289
Customer Service:
Technical Support:
Training Bookings:
Register For the Fulcrum Newsletter HERE

© Fulcrum Management 2012
Verification Code:
Verification Code: