Personal tools
You are here: Home → Training → Programs → Technical Operations Division → Macintosh Forensics Training Program (MFTP)
Document Actions

Macintosh Forensics Training Program (MFTP)

Up one level

The primary purpose of the MFTP course is to train criminal investigators and equip them with the knowledge, skills, and abilities to analysis electronic data stored on Apple computer systems. The MFTP is an intense course that requires substantial computer aptitude and prior computer training in, or equivalent to that presented in the Digital Evidence Acquisition Specialist Training Program (DEASTP) and Seized Computer Evidence Recovery Specialist (SCERS).  DEASTP teaches the proper methodology for acquiring digital evidence in a forensically sound manner; SCERS teaches how to analyze data as well as recover evidence in a Microsoft Windows Environment.

The goal of the MFTP course is to provide the hardware and training to enable the graduate to examine Apple digital evidence as well as provide instruction on the basic use of commercially available forensic software compatible with the Apple/Macintosh file system.

Type: Advanced

Length: The training program encompasses 2 weeks (76 Hours), beginning on a Monday and ending on the second Friday, with the graduation scheduled at approximately 11:00 a.m. Travel days are Sunday and Friday after graduation.

Curriculum

  • Introduction of the Macintosh (OS X)
  • Setting up the Windows and Macintosh workstation
  • Examination, Macintosh Partitions, HFS +
  • Analyzing OS X system data
  • Identification and Searching Techniques
  • Application Analysis
  • Remote Storage Artifacts
  • Native Environment Analysis

Training Materials

Each student is issued a Macintosh Pro desktop computer, Microsoft Windows operating system, Macintosh virtualization software and reference materials to enable the student to put the skills learned in class to use immediately upon return to their organization.

Prerequisites for Attendance

It is highly recommended that you have successfully completed FLETC's Seized Computer Evidence Recovery Specials (SCERS) Training Program and the Digital Evidence Acquisition Training Program (DEASTP).  Applicants that have not attended FLETC's SCERS and DEASTP may attend the MFTP if they have experience and knowledge, acquired through formal education or on-the-job training, which is equivalent to what is presented within the SCERS and DEASTP.

Participants are expected to have experience in the search, seizure and analysis of Windows based computer systems as well as having a good working knowledge of commercially available forensic software.

Contact Information

Training Technician
Technical Operations Training Facility
Bldg. 217
Federal Law Enforcement Training Center
Glynco, GA 31524
Phone: (912) 267-2702
Fax: (912) 267-2797
Fletc-TechnicalOpsTrngFacility@dhs.gov

Training Dates

MFTP-301 / Glynco, GA -- Jan 07, 2013 to Jan 18, 2013
MFTP-302 / Glynco, GA -- May 06, 2013 to May 17, 2013
MFTP-303 / Glynco, GA -- Jun 17, 2013 to Jun 28, 2013