This course teaches the skills required to conduct a digital forensic analysis of an Apple Mac computer.

At a glance

  • Dates
    • 19 - 23 Feb 2018
  • Duration5 days
  • LocationCranfield University at Shrivenham
  • Cost£1,750 - Company (anyone being paid for by their company) Concessions available

Course structure

The course is a 5 day residential. The final day consists of a 3 hour practical examination. The entire course is taught in the computer lab using Apple Macs.

What you will learn

On successful completion of this course those attending will be able to:

  • Analyse Mac OS X digital forensics artefacts at various levels of abstraction, including those related to partitioning, file systems and the operating system
  • Analyse the artefacts left on disk by built-in applications on Mac OS X
  • Construct and carry out a suitable digital forensic analysis approach for an Apple Mac
  • Evaluate the use of Mac OS X for conducting an examination of an Apple Mac against traditional digital forensics tools.

Core content

  • Installation of Mac OS X
  • Use of Mac OS X Terminal
  • The Mac OS X boot process
  • Acquiring disk images using Mac OS X
  • Mounting disk images on Mac OS X
  • Identification of disks and partitions on Mac OS X including APM, MBR and GPT
  • The HFS+ file system
  • Bundles and packages
  • Property Lists
  • Safari browser analysis
  • Mail application analysis
  • Use of Spotlight
  • Log file locations and analysis
  • User accounts and FileVault
  • iOS backups and connected devices
  • PDFs and printing.

Upgrade to a professional qualification

This short course will be taught at Masters standard as it is one of the modules that comprise the postgraduate Forensic Modular Masters Programme. Registering for this accredited short course and successfully passing the associated assessment will gain you 10 Cranfield credits. These could then be used to apply for a transfer towards a PgCert/PgDip or MSc in the Forensic Programme should you wish to complete one of these courses within 5 years.

Who should attend

This course is suitable for any digital forensic analyst with a need to examine Apple Mac computers.


£766 - Individual (anyone paying for themselves to attend).

£383 - Student (a current student from any university or a former student of Cranfield University).

Accommodation options and prices

Please contact us for information regarding accommodation.

Location and travel

Cranfield Defence and Security (CDS) is a Cranfield School based at the Ministry of Defence establishment on the Oxfordshire/Wiltshire borders.

Shrivenham itself lies in the picturesque Vale of the White Horse, close to the M4 motorway which links London and South Wales. It is 7 miles from Swindon, the nearest town, which lies off the M4 at the hub of Britain’s motorway network.

Bath, Cheltenham, Bristol and Oxford are all within an hour’s drive and London less than two hours away by car.

All visitors must be pre-booked in at reception by the person they are visiting on the campus.

For further location and travel details

Read our Professional development (CPD) booking conditions.