Mon, Oct 12


DataExpert Technology Limited

Macintosh Forensic Survival Course

Designed to provide vendor neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order. The course was designed for both the beginner Mac examiner as well as the advanced.

OnDemand training, please contact us for details.

Time & Location

Oct 12, 2020, 9:30 AM GMT+8 – Oct 16, 2020, 3:00 PM GMT+8

DataExpert Technology Limited, Ever Gain Plaza Tower 1, Container Port Road, Kwai Chung, Hong Kong

About the Event


  • Apple Hardware and Tech
  • Introduction to the macOS and the Desktop
  • Understanding CoreStorage, Fusion, FileVault and APFS
  • Imaging Mac RAM
  • Understanding the Mac File System
  • Mac Security Issues and Encryption
  • Password Recovery
  • Building a Mac Forensic Workstation
  • Macintosh Search and Seizure
  • Safely Obtaining System Information
  • Firmware Passwords
  • Volatile Data Collection
  • Manual and Automated Imaging and Acquisition
  • Verifying and Safely Mounting Forensic Images
  • Indexing Forensic Images
  • Search Techniques Using macOS
  • Locating Evidence (Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs and more)
  • Recovering Deleted Files
  • Examining SQLite Databases and PLIST files
  • Using macOS for Forensics
  • Reporting
  • Review of Recommended Applications
  • Review of Automated Forensic Tools
  • Recommended Macintosh Hardware Requirements for Forensics and much more!

Share This Event