Cellebrite Apple Intermediate Forensics (CAIF) is a three (3)-day course designed with hands-on learning and real case scenario data using Cellebrite Inspector software. A CAIF instructor will review log files found on macOS and how to analyze Apple Mail including its structure, mail messages, and related files. The advanced instruction includes a comprehensive exploration of the GUID Partition Table, Terminal, HFS+ and APFS file system, Time Machine Backups, Snapshots and covers the differences between link files, APFS clones, and APFS firmlinks.

Course Learning Objectives

Upon successful completion of this course, students will be able to:

• Interpret log files found on macOS to analyze Apple Mail including its structure, mail messages, and related files.
• Identify evidence related to the use of Terminal as well as utilize Terminal.
• Recognize the GUID Partition Table and understand its structure.
• Understand the Hierarchical File System (HFS+).
• Distinguish and interpret APFS disk structures from varying macOS versions.
• Create, examine, and analyze an APFS disk.
• Recognize and understand the difference between link files, APFS clones, and APFS firmlinks in macOS.
• Understand how Time Machine creates backups and APFS Snapshots and be able to analyze both.

DOWNLOAD COURSE OVERVIEW →

REGISTER NOW →