About the course

🖥️ Hexordia Mac Analysis Course (HMAC)
📍 Location: Virtual
📅 Dates: August 18–22, 2025
📆 Duration: 5 Days
🎯 Skill Level: Intermediate (Basic forensic experience recommended)
📖 Format: Instructor-led, Hands-on Labs

🔍 Course Overview

This course is designed for digital forensic professionals who want to master the ins and outs of macOS forensics. 🍏 You'll learn how to identify and interpret forensic artifacts unique to Apple systems, recover deleted data, perform live and static acquisitions, and analyze common data types. All instruction is grounded in practical, tool-agnostic methodologies, with a strong emphasis on hands-on labs. 🛠️

📚 TOPIC DETAILS

🧱 macOS Background & Basics
Learn about macOS file system evolution from HFS+ to APFS. Understand how modern macOS structures impact forensic analysis. 🧬

📤 macOS Acquisitions
Explore how APFS changes traditional forensic acquisition methods. Learn to acquire data through Target Disk Mode, live imaging, and disk exports. 🛠️

🔐 macOS Forensic Essentials
Dive into key macOS data types: PLists, Protocol Buffers (Protobuf), SQLite, and LevelDB. Understand how these formats are used and stored across the system. 📁

🖥️ Analyzing macOS System Data
Review artifacts left behind by the OS itself: Unified Logs, Apple system logs, usage records, and more. 🧾

👤 Analyzing macOS User Data
Focus on user-generated evidence: browser history, email clients, communication artifacts, and system preferences. Includes guided lab work. 💬📨

🗂️ macOS Backups
Learn to analyze Time Machine backups. Proper mounting and artifact extraction from APFS snapshots. ⏱️

🛡️ Detecting macOS Malware
Understand how to identify malware footprints on macOS. Intro to basic static analysis and reverse engineering concepts. 🧪