Mac Marshal™ Training

We offer a one-day training course on Mac OS X forensics and Mac Marshal. The course includes:

Overview of Mac OS X, including virtual machine and dual-boot operation of Macs
Review of Mac disk formats and the HFS+ file system
Discussion of FileVault home directory encryption
Usage of Spotlight to perform rapid searches of forensic data
Detailed descriptions of common application data/cache formats on OS X
Analysis of forensic data written by the OS and programs such as Safari, Address Book & Mail
Hands-on exercises using Mac Marshal
Certification

Through hands-on training, students will use learn to:

Analyze Mac OS X and dual-boot disk images
Analyze configuration and log files from common OS X applications, such as Mail, Safari, iChat, and Address Book
Perform rapid searches using Spotlight metadata
Gather comprehensive machine usage info
List detailed information about every iPod and iPhone that has been connected to the machine
Detect and extract VMWare, Parallels, and Virtual Box virtual machine images
Detect and analyze FileVault-encrypted user directories
Maintain an audit trail and generate detailed reports in RTF, PDF, and HTML formats

Training Schedule

Mac Marshal training is currently scheduled for

Lakewood CO, March 25 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on March 24)

Dallas TX, April 20 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on April 19)

Austin TX, April 23 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on April 22)

St. Paul MN, May 6 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on May 5)

San Francisco CA, June 15 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on June 14)

Los Angeles CA, June 18 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on June 17)

Wichita KS, July 29 2010 (US state and local law enforcement only)
  (back to back with P2P Marshal training on July 28)

Other dates are being finalized. Please contact us at training at macmarshal dot com for more information about course locations and dates, or to register for one of the sessions above.