7150 Harris Drive 1st Floor, Room 1917
This course prepares students to identify various artifacts typically located in property lists and SQLite databases on MacOS-based computers, as well as learn how to perform forensic analysis. Students gain hands-on practical experience writing basic SQL queries and using to analyze operating system artifacts that includes, but is not limited to, user login passwords, FaceTime®, messages, mail, contacts, calendars, reminders, notes, photos, Safari®, Google Chrome™, and Mozilla Firefox®.
Key concepts covered in this course include:
• Processing basics
• SQLite databases
• SQLite queries
This is an advanced course, intended for digital forensic examiners who have experience working with macOS, and experience preserving and collecting data of evidentiary value.