Personal tools
You are here: Home Training Programs Technical Operations Division Macintosh Forensics Training Program (MFTP)
Document Actions

Macintosh Forensics Training Program (MFTP)

Up one level

The primary purpose of the Macintosh Forensic Training Program  (MFTP) is to train criminal investigators and equip them with the knowledge, skills, and abilities to analyze electronic data stored on Apple computer systems. The MFTP is an intense course that requires substantial computer aptitude and prior computer training equivalent to that presented in the Digital Evidence Acquisition Specialist Training Program (DEASTP) and Seized Computer Evidence Recovery Specialist (SCERS).  DEASTP teaches the proper methodology for acquiring digital evidence in a forensically sound manner; SCERS teaches how to analyze data as well as recover evidence in a Microsoft Windows Environment.

The goal of the MFTP is to provide the hardware and training to enable the graduate to examine Apple digital evidence as well as provide instruction on the basic use of commercially available forensic software compatible with the Apple/Macintosh file system.

Type: Advanced

Length: The training program encompasses 2 weeks (76 Hours), beginning on a Monday and ending on the second Friday, with the graduation scheduled at approximately 11:00 a.m. Travel days are Sunday and Friday after graduation.

Curriculum

  • Introduction of the Macintosh (OS X)
  • Setting up the Windows and Macintosh workstation
  • Examination, Macintosh Partitions, HFS +
  • Analyzing OS X system data
  • Identification and Searching Techniques
  • Application Analysis
  • Remote Storage Artifacts
  • Native Environment Analysis

Training Materials

Each student is issued all of the hardware, software, and reference materials necessary to successfully complete the analysis of a Macintosh computer upon return to their organization.

Prerequisites for Attendance

It is highly recommended that you have successfully completed FLETC's Seized Computer Evidence Recovery Specials (SCERS) Training Program and the Digital Evidence Acquisition Training Program (DEASTP).  Applicants that have not attended FLETC's SCERS and DEASTP may attend the MFTP if they have experience and knowledge, acquired through formal education or on-the-job training, which is equivalent to what is presented within the SCERS and DEASTP.

Participants are expected to have experience in the search, seizure and analysis of Windows based computer systems as well as having a good working knowledge of commercially available forensic software.

Contact Information

Training Technician
Technical Operations Training Facility
Bldg. 217
Federal Law Enforcement Training Center
Glynco, GA 31524
Phone: (912) 267-2702
Fax: (912) 267-2797
Fletc-TechnicalOpsTrngFacility@dhs.gov

Training Dates

G_MFTP-403 / Glynco, GA -- Sep 08, 2014 to Sep 19, 2014