SUMURI - MFSC 201 ADVANCED PRACTICES IN MAC FORENSICS
As each quarter passes, Apple’s success has been nothing but amazing. In addition to desktop and mobile computers, Apple® produces a variety of unique and innovative devices and applications which can be found in just about every modern home and business. As more and more Apple® devices enter the marketplace exponentially, the need for Macintosh Forensic Training is quite apparent. SUMURI’s five-day Macintosh Forensic Survival Course – Level 2 (MFSC-II) was designed to provide unparalleled instruction in advanced topics relating to the forensic use and analysis of Apple® hardware, technologies and applications.
 
As in all of SUMURI’s courses, the training is designed for the participant to learn in a team work environment, and is taught by instructors who maintain a “no one left behind” attitude. In addition, complicated topics are made easy to understand through instructor led exercises and real-life scenarios — supported by a quality student manual to be utilized as a supplemental resource at the completion of the course.
 
Topics
Advanced Command Line
Underneath Mac OS X’s interface and desktop is the Unix shell, including a Terminal that gives users seemingly endless power and control from the “command-line.” Participants will learn advanced tips using this “command-line” to assist in forensic examinations of a Mac.
Advanced File System Analysis
Students will be introduced to the concept of domains within the Mac OS X environment and be able to locate evidentiary artifacts. Additionally, students will learn how to manually deconstruct third-party applications.
AppleScript and Automator
Included with Mac OS X are two applications that allow the user to develop custom applications and workflows to automate almost any task. Participants will learn how to create their own AppleScript and Automator applications to simplify a forensic examination.
Identifying and Using Virtual Machines
Participants will learn how to identify the use of a VM within Mac OS X, and the procedures necessary to analyze them. In addition, the participant will learn how to use a VM to assist in forensic examinations from within the Mac environment.
Apple Timeline Analysis
Timeline Analysis is one of the most popular investigative trends in Digital Forensics and for good reason. Timeline Analysis can recreate the history of a device’s usage step-by-step and second by second. Learn what Timestamps exist on a Mac, how they can be extracted and how to use the results to enhance your investigation.
Mac OS X Server Forensics
Participants will learn about Mac OS X server technology, including services and user accounts. Instruction will be provided on best practices for acquiring data safely from live systems, as well as responding to an incident on compromised systems.
Mac OS X Server Forensics
iCloud Forensics
Unique Apple Technology
Advanced Search Techniques
Application Deconstruction
Freebie
Course Manual
PALADIN Forensic Suite