Class Description:
This 40-hour course is designed to give high tech-computer forensic investigators working knowledge of Apple devices, the Operating System, and conducting forensic examinations of Mac media. Students will learn how to navigate in and work with the Apple’s OS X and Linux environments.
Apple Computers supports the Mac OS and provides an environment to run Windows, Linux, and the UNIX-based Operating Systems. Because of this versatility, investigators are performing more forensic investigations on Apple computers.
Teaching Methods:
Lecture, hands-on exercises, instructor-led exercises, and self-paced lab work.
Objectives:
Students will build a foundation of understanding the Mac OS X, UNIX, and Linux operating system environments and hands-on experience in those environments. Students will use Mac laptops with the OS X operating system. The course will explain file system structure, operating system components, location of forensically relevant files and folders, examination and analysis, and a comparison of Mac- vs. Windows-based examinations.
Prerequisites:
Students must have completed D300 Computer Digital Evidence Recovery; D310 Specialized Tools; and D400 Advanced Forensics for the Investigator courses.
Preparation:
Students should be peace officers assigned to a computer crime unit/task force who are assigned responsibility for computer forensic investigations.