Advanced Digital Forensic Analysis: macOS

This course prepares students to identify various artifacts typically located in property lists and SQLite databases on MacOS-based computers, as well as learn how to perform forensic analysis. Students gain hands-on practical experience writing basic SQL queries and using to analyze operating system artifacts that includes, but is not limited to, user login passwords, FaceTime®, messages, mail, contacts, calendars, reminders, notes, photos, Safari®, Google Chrome™, and Mozilla Firefox®.

Key concepts covered in this course include: 
     • Processing basics
     • SQLite databases
     • SQLite queries
     • Artifacts

This is an advanced course, intended for digital forensic examiners who have experience working with macOS, and experience preserving and collecting data of evidentiary value.