Macintosh Forensics Training Program (MFTP)Up one level
The primary purpose of the Macintosh Forensic Training Program (MFTP) is to train criminal investigators and equip them with the knowledge, skills, and abilities to analyze electronic data stored on Apple computer systems. The MFTP is an intense course that requires substantial computer aptitude and prior computer training equivalent to that presented in the Digital Evidence Acquisition Specialist Training Program (DEASTP) and Seized Computer Evidence Recovery Specialist (SCERS). DEASTP teaches the proper methodology for acquiring digital evidence in a forensically sound manner; SCERS teaches how to analyze data as well as recover evidence in a Microsoft Windows Environment.
The goal of the MFTP is to provide the hardware and training to enable the graduate to examine Apple digital evidence as well as provide instruction on the basic use of commercially available forensic software compatible with the Apple/Macintosh file system.
Length: The training program encompasses 2 weeks (76 Hours), beginning on a Monday and ending on the second Friday, with the graduation scheduled at approximately 11:00 a.m. Travel days are Sunday and Friday after graduation.
- Introduction of the Macintosh (OS X)
- Setting up the Windows and Macintosh workstation
- Examination, Macintosh Partitions, HFS +
- Analyzing OS X system data
- Identification and Searching Techniques
- Application Analysis
- Remote Storage Artifacts
- Native Environment Analysis
Each student is issued all of the hardware, software, and reference materials necessary to successfully complete the analysis of a Macintosh computer upon return to their organization.
Prerequisites for Attendance
It is highly recommended that you have successfully completed FLETC's Seized Computer Evidence Recovery Specials (SCERS) Training Program and the Digital Evidence Acquisition Training Program (DEASTP). Applicants that have not attended FLETC's SCERS and DEASTP may attend the MFTP if they have experience and knowledge, acquired through formal education or on-the-job training, which is equivalent to what is presented within the SCERS and DEASTP.
Participants are expected to have experience in the search, seizure and analysis of Windows based computer systems as well as having a good working knowledge of commercially available forensic software.
Technical Operations Training Facility
Federal Law Enforcement Training Center
Glynco, GA 31524
Phone: (912) 267-2702
Fax: (912) 267-2797
- G_MFTP-402 / Glynco, GA -- Mar 24, 2014 to Apr 04, 2014
- G_MFTP-403 / Glynco, GA -- Sep 08, 2014 to Sep 19, 2014