Computer Forensics-Macintosh/Linux

  1. Home
  2. Advanced Training Center
  3. Computer Forensics-Macintosh/Linux

Course Description - This 40 hour course is designed to give high tech-computer forensic investigators working knowledge of Apple devices, the Operating System, and conducting forensic examinations of Mac media. Students will learn how to navigate in and work with the Apple’s OS X and Linux environments. (GUI: Graphical User Interface and command line).

Apple Computers not only support the Mac OS, but also now provide an environment to run Windows, Linux, and the UNIX-based Operating Systems. Because of this versatility, they are becoming more mainstream and investigators are performing more forensic investigations on Apple computers. Law Enforcement agencies are quickly shifting to Mac computers as their forensic machine. The Mac systems offer flexibility, provide a robust platform, and capable handling the Mac and Windows environment seamlessly.

This course will consist of lecture, hands on exercises, instructor led exercises, and self-paced lab work.

Who Should Attend - Peace officers assigned to a computer crime unit/task force who are assigned responsibility for computer forensic investigations.

Pre-requisites - Students must have completed the Advanced Training Center’s Computer Digital Evidence Recovery; Specialized Tools; and the Avanced Forensics for the Investigator courses.

Course Objectives - The objective of this course is to give students a foundation of understanding the Mac OS X, UNIX, and Linux operating system environments and hands-on experience in those environments. Students will use Mac laptops with the OSX operating system. The course will explain file system structure, operating system components, location of forensically relevant files and folders, examination and analysis, and a comparison of Mac vs. Windows based examinations.

Course Outline

  • Installation/Setup of Mac OSX/BootCamp/Windows Environment
  • Mac/OS X navigation and file structure
  • Disk Arbitration
  • EFI/Boot Sequence
  • Terminal/Command Line Analysis
  • Device Identification
  • Mounting of Devices: Physical/Logical
  • Imaging Media
  • File locations, types, naming conventions, and permissions
  • Mail Analysis: Apple/Entourage
  • Safari Web Browsing Analysis
  • File Searching/Spotlight
  • Time Capsule/FileVault

Additional Information - For further information, contact the ATC at (916) 464-1200, and ask for the Program Training Manager or Secretary for this course.