Cellebrite Apple Advanced Forensics (CAAF) is a three (3)-day, course designed with hands-on learning and real case scenario data using Cellebrite Inspector software. Participants will learn how to recover artifacts from allocated and unallocated space. A CAAF instructor will review the most important macOS and iOS digital artifacts common to most investigations. The advanced instruction includes a comprehensive exploration of macOS and iOS systems, deleted files from HFS+ and APFS file systems, hardware and software RAIDS, log files, extended artifacts and password data.

Click Here for more information

• Distinguish how to handle deleted files from both APFS and HFS+. 
• Demonstrate how to recover artifacts from allocated and unallocated space.
• Breakdown hardware and software RAID. l Understand iOS analysis advanced practices.
• Utilize log files to recreate usage history and create a timeline.
• Understand and examine Extended Attributes, Spotlight evidence, and file sharing artifacts.
• Identify and utilize how passwords are saved and used in macOS.