Cellebrite Apple Forensics (CAF) is a five (5)-day, course designed with hands-on learning and real case scenario data. Participants will learn how to perform both triage and analysis of specific data points that exist within operating system and file system artifacts. A CAF instructor will guide attendees through the most important macOS and iOS digital artifacts. The macOS and iOS operating systems, HFS+ and APFS file systems and significant application data are explored throughout the class.
Upon concluding this course, students will have reviewed up to three different case scenarios covering various file system, operating system and application artifacts relevant to real-life cases. Analysis methodologies are covered via hands-on work with actual data and instructor-led exercises. Knowledge is validated with an individual written and practical assessment. Through an interactive, hands-on approach, students will gain a strong familiarity of macOS and iOS artifacts and the confidence with which to conduct thorough examinations.
Note: While all are welcome, strong computer skills and an understanding of basic forensic concepts (imaging, live data acquisition, and evidence handling) are highly recommended for the optimal experience in this course.