Through hands-on learning and case-based scenarios, students will learn from experts how to perform both triage and analysis of specific data artifacts that exist within Apple’s® devices, including operating system and file system artifacts. This course will guide students through the most important macOS and iOS device areas. The macOS and iOS operating systems, HFS+ and APFS file systems and significant application data are explored.

While all are welcome, strong computer skills and an understanding of basic forensic concepts (imaging, live data acquisition, and evidence handling) are highly recommended for the optimal experience in this course.

Upon concluding this course, students will have reviewed up to three different case scenarios covering various file system, operating system and application artifacts relevant to real-life cases.

• Analysis methodologies are covered via hands-on work with actual data and instructor-led exercises.
• Knowledge is validated with an individual written and practical assessment.

Through an interactive, hands-on approach, students will gain a strong familiarity of macOS and iOS artifacts and the confidence with which to conduct thorough examinations.