Mac Marshal™ Training

We offer a one-day training course on Mac OS X forensics and Mac Marshal. The course includes:

Overview of Mac OS X, including virtual machine and dual-boot operation of Macs
Review of Mac disk formats and the HFS+ file system
Discussion of FileVault home directory encryption
Usage of Spotlight to perform rapid searches of forensic data
Detailed descriptions of common application data/cache formats on OS X
Analysis of forensic data written by the OS and programs such as Safari, Address Book & Mail
Hands-on exercises using Mac Marshal
Certification

Through hands-on training, students will use learn to:

Analyze Mac OS X and dual-boot disk images
Analyze configuration and log files from common OS X applications, such as Mail, Safari, iChat, and Address Book
Perform rapid searches using Spotlight metadata
Gather comprehensive machine usage info
List detailed information about every iPod and iPhone that has been connected to the machine
Detect and extract VMWare, Parallels, and Virtual Box virtual machine images
Detect and analyze FileVault-encrypted user directories
Maintain an audit trail and generate detailed reports in RTF, PDF, and HTML formats

Training Schedule

Macintosh Forensics Training is currently scheduled for

Wichita KS, July 29 2010 (US state and local law enforcement only)
  (back to back with P2P Forensics training on July 28)

Portland OR, August 5 2010 (US state and local law enforcement only)
  (back to back with P2P Forensics training on August 6)

Atlanta GA, September 23 2010 (US state and local law enforcement only)
  (back to back with P2P Forensics training on September 22)

Other dates are being finalized. Please contact us at training at macmarshal dot com for more information about course locations and dates, or to register for one of the sessions above.