Cellebrite Apple Intermediate Forensics v1.0.0 (CAIF) - OnDemand

Course type: On Line On Demand
Location: On demand
Log in to see the options to register for this course. If you do not already have an account, create your FREE account. Creating an account does not obligate you to enroll or pay for classes.

About this course

Description

Cellebrite Apple Intermediate Forensics (CAIF) is a three (3)-day course designed with hands-on learning and real case scenario data using Cellebrite Inspector software. Participants will analyze mounted volume evidence, device connection evidence, and network connections in macOS. A CAIF instructor will review log files found on macOS and iOS devices and how to analyze Apple Mail including its structure, mail messages, and related files. The advanced instruction includes a comprehensive exploration of the GUID Partition Table, Terminal, HFS+ and APFS file system, Time Machine Backups, Snapshots and understand the difference between link files, APFS clones, and APFS firmlinks.

Click Here for more information




Learning objectives

Learning Objectives

  • Analyze mounted volume evidence, device connection evidence, and network connections in macOS.
  • Interpret log files found on macOS and iOS devices to analyze Apple Mail including its structure, mail messages, and related files.
  • Identify evidence related to the use of Terminal as well as utilize Terminal.
  • Recognize the GUID Partition Table and understand its structure.
  • Understand the Hierarchical File System (HFS+). l Distinguish and interpret APFS disk structures from varying macOS versions.
  • Create, examine, and analyze an APFS disk. 
  • Recognize and understand the difference between link files, APFS clones, and APFS firmlinks in macOS. 
  • Understand how Time Machine creates backups and APFS Snapshots and be able to analyze both.