Mac Marshal™ Training

We offer a one-day training course on Mac OS X forensics and Mac Marshal. The course includes:

  • Overview of Mac OS X, including virtual machine and dual-boot operation of Macs
  • Review of Mac disk formats and the HFS+ file system
  • Discussion of FileVault home directory encryption
  • Usage of Spotlight to perform rapid searches of forensic data
  • Detailed descriptions of common application data/cache formats on OS X
  • Analysis of forensic data written by the OS and programs such as Safari, Address Book & Mail
  • Hands-on exercises using Mac Marshal
  • Certification

Through hands-on training, students will learn to:

  • Analyze Mac OS X and dual-boot disk images
  • Analyze configuration and log files from common OS X applications, such as Mail, Safari, iChat, and Address Book
  • Perform rapid searches using Spotlight metadata
  • Gather comprehensive machine usage info
  • List detailed information about every iPod and iPhone that has been connected to the machine
  • Detect and extract VMWare, Parallels, and Virtual Box virtual machine images
  • Detect and analyze FileVault-encrypted user directories
  • Maintain an audit trail and generate detailed reports in RTF, PDF, and HTML formats

Training Schedule

Please contact our Training Coordinator for more information.