Cellebrite Advanced Apple® Forensics
Cellebrite Apple Advanced Forensics (CAAF) is a three (3)-day, course designed with hands-on learning and real case scenario data using Cellebrite Inspector software. Participants will learn how to recover artifacts from allocated and unallocated space. A CAAF instructor will review the most important macOS and iOS digital artifacts common to most investigations. The advanced instruction includes a comprehensive exploration of macOS and iOS systems, deleted files from HFS+ and APFS
Attendees should have above-average computer skills, should have attended Apple® Forensic Investigations or other validated Mac Training course(s) and be comfortable working in macOS, HFS+ and APFS at more than a casual user level. This course is for advanced examiners who desire a deep dive into the challenges presented by Apple devices, specifically APFS, encryption, CoreStorage, Fusion, RAIDS, Time Machine, etc.
Those who do not already possess the necessary knowledge base and familiarity with Mac and iOS devices may struggle to successfully complete this class.
Upon concluding this course, students will have reviewed up to three different case scenarios covering analysis methodologies with the instructor. The class culminate with a comprehensive written and practical assessment of knowledge gained. With a working, hands-on approach, using relevant, contemporary data covering current issues and solutions, students will gain a strong understanding of macOS and iOS artifacts and the confidence with which to conduct accurate and comprehensive examinations.