Course Overview
    The introduction of the iPod, iPhone, and iPad and the use of Intel-based processors have generated a steep increase in the sales of Macintosh computers, which are no longer restricted to the realm of desktop publishing and computer-aided design.
    Computer users are attracted by the design of the Macintosh, its UNIX-like stability, ease-of-use, and its ability to run Microsoft® Windows. Most die-hard Windows users will refuse to return their Mac once they’ve started using it.
    This Expert Series course makes a departure from the world of Microsoft Windows. It capitalizes on the similarity of Mac OS X and Linux and brings the examination of the two operating systems together.
    Notwithstanding the dual nature of the course, its prime focus is on Macintosh examinations. This takes into account the fact that most retail computer systems are either IBM PC-compatible machines running Windows or else Macs – few retail systems come with Linux pre-installed. The other reason for concentrating on Macs is that the restriction of running Mac OS X on non-Apple hardware has resulted in the average examiner having less knowledge of Mac OS X that they do on Linux.

    The focus on Mac examinations doesn’t mean to say that Linux is a poor relative on the course – far from it; much of the Mac content is relevant to Linux as well.
    It’s important to note that the examination of Macintosh computers will invariably require the examiner to have access to their own Macintosh examination machine. This course will demonstrate a number of Mac examination techniques but it’s not currently possible to furnish each student with their own Macintosh computer. Students who wish to practice these techniques while attending the course will need to bring their own Intel-based Macintosh notebook computer, one that is configured to run the latest version of Mac OS X and, optionally, a copy of the Xcode Developer’s tools (available to download from the Apple App Store).

    Delivery method: Group-Live. NASBA defined level: advanced.

    The course’s topics will cover:
CPE Credits
    32
Training Level
    Expert
Prerequisite
        EnCase® Computer Forensics II or EnCE® Certification. Advance preparation for this course is not required.
      Who Should Attend
      • This course is intended for EnCase® Forensic v7 users working as law enforcement officers, computer forensic examiners, corporate and private investigators, and network security personnel. A basic understanding of the concepts of computer forensics is required. The class curriculum builds upon the foundation of the EnCase® Computer Forensics II course, continuing with a focus on conducting examinations of the Macintosh and Linux operating systems.
      Tuition
      • Tuition is $2,995.00 USD per student.
      • See Class Details for Actual Tuition Costs
        Macintosh history and development, acquisition, and disk layout
        HFS+ volume structure, including in-depth analysis of the Catalog and Extents Overflow files and low-level file recovery
        Fundamental Mac OS X operations, Mac disk, and disk-image analysis and acquisition
        Max OS X system, user, application, and Internet artifacts
        Linux history and development, disk layout, and device nomenclature
        Ext2/3 volume, directory, and Inode structure; the structure and nature of hard and soft links
        Linux partition recovery
        Linux operating system architecture and artifacts
        Linux operating system architecture and artifacts
        Using Linux for the purpose of forensic acquisitions
        LinEn command-line usage
      Syllabus


      SELECT LOCATION  SELECT DATE COURSE INFORMATION

      DIRECTIONS
      For more information regarding refund concerns and program cancellation policies, contact Guidance Software Training at training@guidancesoftware.com or call 626.229.9191 ext. 566.