Apple Forensic Investigation online lectures are coming up on Tuesday 8 December and Wednesday 9 December starting at 5pm (17h). The lectures will be held in English by Bruce Hunter and Matt McFadden of the BlackBag. Learn a little bit about their background below. In the online lectures, the students will learn about the challenges of macOS forensics and how to best acquire and analyze data from Apple systems.

Some of the topics covered will be:

  • important steps needed to triage and image legacy and current systems
  • considerations in dealing with T1 and T2 chip systems along with acquiring data from the new M1 systems
  • the imaging strategies
  • overview of macOS systems
  • environment for macOS: from new macOS volumes to file system configurations

These lectures will guide students through MacOS system files, related data, how dates and times function, and the structure and meaning of library folders. The complexities and challenges of imaging and analyzing Apple® systems and related macOS evidence explored will be reviewed to ensure students understand the challenges of macOS forensics.

Tuesday 8 December 2020 – 4 hours

  • Challenges of computer forensics
  • Windows-based examinations and challenges
  • Investigative Windows forensics and new evidence
  • Apple® system acquisitions – protections

Wednesday 9 December 2020 – 4 hours

  • Apple® system encryption and assessment
  • macOS analysis complexities
  • APFS and HFS+ file system evidence
  • New macOS 11 examination considerations for 2021

Learn about the field experts holding the online lectures below.

Bruce Hunter BIO

Bruce retired after 29 years of policing split between Toronto and Guelph Police Departments in Ontario, Canada. He worked in several investigative units throughout his career including: General Investigations, Youth Crime, Gangs/Street Crime, Sexual Assault and Child Abuse. Bruce was instrumental in creating the Internet Child Exploitation and Technological Crimes Unit at the Guelph Police. He has testified at court on both numerous Child Exploitation and Computer/Mobile Forensics cases and has been declared an expert in a number of fields in Ontario and New York. Bruce has lectured and presented at a number of forensic and legal conferences.

Matt McFadden BIO

Matt is an honorably retired Police Sergeant with the Clovis Police Department with over 20 years of digital forensic experience including expert testimony in state superior and U.S. federal courts. His digital forensic case work has been featured by CNN, People Magazine, New York Times, TruTV, Oxygen Channel’s show Snapped, and in the book “Caught in the Web – Inside the Police Hunt to Rescue Children from Online Predators” by Julian Sher. In addition to holding multiple industry recognized digital forensic and incident response certifications, Matt has been writing and instructing digital forensic curriculum at domestic and international venues for over 16 years.