Macintosh Forensics Training Program (MFTP)Up one level
The primary purpose of the MFTP course is to train criminal investigators and equip them with the knowledge, skills, and abilities to analysis electronic data stored on Apple computer systems. The MFTP is an intense course that requires substantial computer aptitude and prior computer training in, or equivalent to that presented in the Digital Evidence Acquisition Specialist Training Program (DEASTP) and Seized Computer Evidence Recovery Specialist (SCERS). DEASTP teaches the proper methodology for acquiring digital evidence in a forensically sound manner; SCERS teaches how to analyze data as well as recover evidence in a Microsoft Windows Environment.
The goal of the MFTP course is to provide the hardware and training to enable the graduate to examine Apple digital evidence as well as provide instruction on the basic use of commercially available forensic software compatible with the Apple/Macintosh file system.
Length: The training program encompasses 2 weeks (76 Hours), beginning on a Monday and ending on the second Friday, with the graduation scheduled at approximately 11:00 a.m. Travel days are Sunday and Friday after graduation.
- Introduction of the Macintosh (OS X)
- Setting up the Windows and Macintosh workstation
- Examination, Macintosh Partitions, HFS +
- Analyzing OS X system data
- Identification and Searching Techniques
- Application Analysis
- Remote Storage Artifacts
- Native Environment Analysis
Each student is issued a Macintosh Pro desktop computer, Microsoft Windows operating system, Macintosh virtualization software and reference materials to enable the student to put the skills learned in class to use immediately upon return to their organization.
Prerequisites for Attendance
It is highly recommended that you have successfully completed FLETC's Seized Computer Evidence Recovery Specials (SCERS) Training Program and the Digital Evidence Acquisition Training Program (DEASTP). Applicants that have not attended FLETC's SCERS and DEASTP may attend the MFTP if they have experience and knowledge, acquired through formal education or on-the-job training, which is equivalent to what is presented within the SCERS and DEASTP.
Participants are expected to have experience in the search, seizure and analysis of Windows based computer systems as well as having a good working knowledge of commercially available forensic software.
Technical Operations Training Facility
Federal Law Enforcement Training Center
Glynco, GA 31524
Phone: (912) 267-2702
Fax: (912) 267-2797
- MFTP-303 / Glynco, GA -- Jun 17, 2013 to Jun 28, 2013