MFSC-101: Orlando, Florida

Name: MFSC-101: Orlando, Florida
Start: 2025-04-28T00:00:00-04:00
End: 2025-05-02T23:59:59-04:00

April 28, 2025 - May 2, 2025

Best Practices in Mac Forensics will be presented by SUMURI from April 28 – May 2, 2025, 8:00 AM to 5:00 PM EDT.

SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.

MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME).
Start your journey to certification and elevate your expertise today!

Note: Students will need access to a Mac computer running the current version of macOS for the course.

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

Details

Start:: April 28, 2025
End:: May 2, 2025
Event Categories:: Best Practices in Mac Forensics, Macintosh Forensics Training