Certified Apple Mac Forensics Specialist (CMFS)

Product Description

This Mac forensics training course (3 days) gives delegates a practical understanding of:

• Data structures & potential evidence as produced in Apple Mac OS X environments
• Implementing forensic tools on Mac OS X-based file systems
• Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Mac Forensics Specialist (CMFS) qualification.

This is a Hands-On course where delegates will carry out exercises, applying the principles, knowledge & techniques learnt during the course.

Mac OS X adopted the GUID Partition Table scheme for its partition layout on the hard drive. Unlike Vista, which also supports GPT but does not generally use it, OS X will prefer this partitioning scheme. We will delve into partition setup using GPT
- you will be interested in case your forensic tool of choice does not like GPT & does not successfully search for HFS+ partitions, either.

Since Mac OS X Leopard (v 10.5, October 2007), the operating system comes with a new feature forensic investigators will be interested in: Time Machine. As the operating system notoriously suggests to the user to use Time Machine to automatically create backups at fixed intervals, many Mac users will have backups created that might contain data of relevance even if the current system does not. As Apple puts it: Set it, then forget it.

This training may be available onsite; please contact us if you are interested.