MFSC-101 provides detailed instruction on the process of examining a Macintosh computer from the first step to last step in logical order.

It is the most up to date course on Mac Forensics, focusing on providing the student with in-depth knowledge and hands-on skills allowing them to conduct an examination using any forensic tool on any platform. It provides the necessary knowledge to understand the intricacies of the macOS and how critical data is stored. This, along with advanced topics on macOS, provides the student with the tools to find, analyse and understand critical data which can be used in support of their investigations.

MFSC-101 features topics such as:

Additional topics include:

• Safely Obtaining System Information

• Volatile Data Collection

• Imaging and Acquisition

• Verifying and Safely Mounting Forensic Images

• Search Techniques Using macOS

• Locating Evidence (Apple Native Applications)

• Recovering Deleted Files

• Examining SQLite Databases and PLIST files

• Using macOS for Forensics