We offer a one-day training course on Mac OS X forensics and Mac Marshal. The course includes:

• Overview of Mac OS X, including virtual machine and dual-boot operation of Macs
• Review of Mac disk formats and the HFS+ file system
• Discussion of FileVault home directory encryption
• Usage of Spotlight to perform rapid searches of forensic data
• Detailed descriptions of common application data/cache formats on OS X
• Analysis of forensic data written by the OS and programs such as Safari, Address Book & Mail
• Hands-on exercises using Mac Marshal
• Certification

Through hands-on training, students will learn to:

• Analyze Mac OS X and dual-boot disk images
• Analyze configuration and log files from common OS X applications, such as Mail, Safari, iChat, and Address Book
• Perform rapid searches using Spotlight metadata
• Gather comprehensive machine usage info
• List detailed information about every iPod and iPhone that has been connected to the machine
• Detect and extract VMWare, Parallels, and Virtual Box virtual machine images
• Detect and analyze FileVault-encrypted user directories
• Maintain an audit trail and generate detailed reports in RTF, PDF, and HTML formats

Training Schedule

We continue to schedule dates for Mac Marshal Training and will update this site when dates are finalized. Please contact our Training Coordinator for more information.

The following dates are tentative, but we are accepting your registrations.  Once we receive final approval from NIJ, we will confirm the dates.  Register now to reserve your place.

• March 1, 2012 - Brooklyn, NY
• March 22, 2012 - Phoenix, AZ
• May 9, 2012 - Frankfort, KY (tentative)
• June 13, 2012 - St. Charles, IL (tentative)

To register for one of the training classes listed above, please contact our Training Coordinator with the following information:

• Your name
• U.S. Law Enforcement agency name
• Work address
• E-mail address
• Work Phone number
• Class date and location you are interested in