U.S. flag

An official website of the United States government, Department of Justice.

Advanced Digital Forensic Analysis: macOS

© rawpixel-com/freepik.com (see reuse policy).
Event Dates
Michigan State Police, Headquarters

7150 Harris Drive 1st Floor, Room 1917
Dimondale, MI

This course prepares students to identify various artifacts typically located in property lists and SQLite databases on MacOS-based computers, as well as learn how to perform forensic analysis. Students gain hands-on practical experience writing basic SQL queries and using to analyze operating system artifacts that includes, but is not limited to, user login passwords, FaceTime®, messages, mail, contacts, calendars, reminders, notes, photos, Safari®, Google Chrome™, and Mozilla Firefox®.

Key concepts covered in this course include: 
     • Processing basics
     • SQLite databases
     • SQLite queries
     • Artifacts

This is an advanced course, intended for digital forensic examiners who have experience working with macOS, and experience preserving and collecting data of evidentiary value.

Date Created: June 13, 2022