Cellebrite Apple Intermediate Forensics (CAIF) is a three (3)-day course designed with hands-on learning and real case scenario data using Cellebrite Inspector software. Participants will analyze mounted volume evidence, device connection evidence, and network connections in macOS. A CAIF instructor will review log files found on macOS and iOS devices and how to analyze Apple Mail including its structure, mail messages, and related files. The advanced instruction includes a comprehensive exploration of the GUID Partition Table, Terminal, HFS+ and APFS file system, Time Machine Backups, Snapshots and understand the difference between link files, APFS clones, and APFS firmlinks.

Click Here for more information

• Analyze mounted volume evidence, device connection evidence, and network connections in macOS.
• Interpret log files found on macOS and iOS devices to analyze Apple Mail including its structure, mail messages, and related files.
• Identify evidence related to the use of Terminal as well as utilize Terminal.
• Recognize the GUID Partition Table and understand its structure.
• Understand the Hierarchical File System (HFS+). l Distinguish and interpret APFS disk structures from varying macOS versions.
• Create, examine, and analyze an APFS disk. 
• Recognize and understand the difference between link files, APFS clones, and APFS firmlinks in macOS. 
• Understand how Time Machine creates backups and APFS Snapshots and be able to analyze both.