RECON: Mac OS X Forensic Training & Certification
![Udemy](https://static.mytechlogy.com/cache/964106a4c2e4e7ae2e50603b55929311_w30_h30_cp_sc.png)
Udemy
Course Summary
The official RECON training - learn how to use it to locate, analyze, interpret & report on OS X evidence
-
+
Course Description
Class Overview This is the official RECON training and certification by Sumuri focused on providing students detailed instruction on the features of the tool as well as OS X forensics. RECON will change your life as a Mac examiner and have you up and running locating, analyzing and reporting on your evidence in minutes or hours instead on days or weeks. With over 40 forensic modules, custom timeline features, file search options, and more, RECON reduces the complex process of identifying forensic artifacts, extracting and decoding the data and presenting it in a workable format to a few key strokes. The training also includes learning how to interpret your findings, so you will be learning OS X forensics along the way and be able to explain your findings to those that will be relying on your results. This is hands-on training with dozens of skill building practicals to re-enforce learning. Goals Students will learn RECON basics such as how to set up cases and become familiar with the features RECON has to offer. RECON’s forensic modules are covered and students will learn how to apply them to locate, analyze, interpret and report on findings. The Global Timeline feature, one of the best features you can use to advance an investigation, is covered in-depth and students will learn how to create custom timelines and interpret the findings. Students learn how to effectively use the other features RECON has to offer such as Advanced File Search options and RAM extractions. Completion of the course ultimately leads to being certified by Sumuri in RECON. Audience RECON for Mac OS X is designed for both the novice and advanced forensic examiners and investigators. It was designed from the ground up for those that need a Mac forensic tool that can quickly parse and present in-depth findings. It was also built to be versatile and have the ability to be brought out for field work. It’s easy to use interface makes it perfect for newer users yet experienced forensic analysts will find many advanced options available as well as detailed information about recovered artifacts. COURSE TOPICS 1. Introduction This section introduces you to the class and helps you understand how the class is structured. Topics address :
- How to obtain RECON for the class
- How the training is structured
- How to get the most out of the training
- Materials to download
- RECON certification process
- Overview of RECON
- Customizing RECON
- Mounting image files
- Creating a new case
- Loading a case
- Getting setup for the class practicals
- OS X layout from a forensic point-of-view
- Understanding OS X file system dates & times
- Understanding OS X Metadata dates & times
- Finder Sidebar
- Calendar
- Contacts
- Notes
- iOS Backups
- Connected iOS devices
- iCloud
- Apple Maps
- iPhoto
- Apple Mail
- Messages
- Skype
- Airport
- Bluetooth
- Network Interfaces
- Network Preferences
- User Recent items
- Attached USB Devices
- User .Trash
- Installed Applications
- Installed Hardware
- User Bash History
- Disk Utility artifacts
- Deleted User Accounts
- Parallels
- Virtual Box
- Safari
- Firefox
- Chrome
- Data Destruction/ Spoliation Artifcats
- Geographical Location (GEO) Tags
- Online User Accounts
- File Source artifacts
- Dropbox
- Documents
- Images
- Video
- Audio
- Torrent Files
- BitTorrent
- uTorrent
- Vuze
- Creating & customizing a timeline
- File timeline interpretation
- Global timeline interpretation
- Setup
- System uptime
- Mounted volumes
- Opened files
- Running processes
- System profile data
- Logged users
- Active networks
- Global Search
- Module Search
- RAM extraction
- Password feature
- File Signature database customization
- File Extension database customization
- Keyword database customization
- Module reports
- Global reports
-
+
Course Syllabus
- Welcome & Introduction
- Welcome & Introduction
- How to get the most out of this training
- Training Module Layout
- Getting RECON for the class
- Materials to download for version 1.0.7
- Materials to download for version 1.0.9
- Materials to download version 1.0.11
- How to get your Udemy Certificate
- How to get your RECON Certification
- RECON Basics
- RECON Overview
- Customizing RECON
- Mounting Images
- Creating a case
- Loading a case & getting set up for the practicals
- Mac Forensics Basics
- Understanding the OS X Layout
- Understanding OS 10.7+ Time Stamps
- Accessing Apple Extended Metadata
- Apple Artifacts: Finder Sidebar
- Practical 4A: Finder Sidebar Part 1
- Practical 4A: Finder Sidebar Part 2
- Practical 4B: Find Sidebar Evidence
- Sidebar Quiz
- Sidebar Practical Answers
- Apple Artifacts: Calendar
- Practical 5A: Calendar
- Practical 5B: Calendar Evidence
- Calendar Quiz
- Calendar Practical Answers
- Apple Artifacts: Contacts
- Practical 6A: Contacts
- Practical 6B Contacts Evidence
- Contacts Quiz
- Contact Practical Answers
- Apple Artifacts: Apple Mail
- Practical 7A: Apple Mail
- Practical 7B: Apple Mail Evidence
- Apple Mail Quiz
- Apple Mail Practical Answers
- Apple Artifacts: Notes
- Practical 7C: Apple Notes
- Practical 7D: Apple Notes Questions
- Apple Notes Quiz
- Apple Maps Practical Answers
- Apple Artifacts: Connected iOS Devices & iOS Backups
- Practical 8A iOS
- Practical 8B iOS Evidence
- iOS Quiz
- iOS Practical Answers
- Apple Artifacts: iCloud
- Practical 8C iCloud
- Practical 8D iCloud Evidence
- iCloud Quiz
- iCloud Practical Answers
- Messages
- Practical 9A Messages
- Practical 9B Messages Evidence
- Messages Quiz
- Messages Practical Answers
- Skype
- Practical 10A Skype
- Practical 10B Skype Evidence
- Skype Quiz
- Skype Practical Answers
- Network Evidence: Airport
- Practical 11A Airport
- Practical 11B Airport Evidence
- Airport Quiz
- Airport Practical Answers
- Network Evidence: Bluetooth
- Lesson 12A Bluetooth
- Network Evidence: Network Interfaces
- Practical 13A Network Interfaces
- Practical 13B Network Interfaces Evidence
- Network Interfaces Quiz
- Network Interfaces Practical Answers
- Network Evidence: Network Preferences
- Practical 14A Network Preferences
- Practical 14B Network Preferences Evidence
- Network Preferences Quiz
- Network Preferences Practical Answers
- System Evidence: Apple Dock
- Practical: Apple Dock
- Practical Apple Dock Evidence
- Apple Dock Quiz
- System Evidence: Installed Applications
- Practical 15A Installed Applications
- Practical 15B Installed Applications Evidence
- Installed Application Quiz
- Installed Applications Practical Answers
- System Evidence: Installed Hardware
- Practical 16A Installed Hardware
- Practical 16B Installed Hardware Evidence
- Installed Hardware Quiz
- Installed Hardware Practical Answers
- Quarantine Events
- Practical Quarantine Events
- Practical Quarantine Events Evidence
- Quarantine Events Quiz
- System Evidence: Recent Items
- Practical 17A Recent Items
- Practical 17B Recent Item Evidence
- Recent Item Quiz
- Recent Item Practical Answers
- System Evidence: Trash
- Practical 18A Trash
- Practical 18B Trash Evidence
- Trash Quiz
- Trash Practical Answers
- System Evidence: Bash History
- Practical 19A Bash History
- Practical 19B Bash History Evidence
- Bash History Quiz
- Bash History Practical Answers
- System Evidence: Disk Utility
- Practical 20A Disk Utility
- Practical 20B Disk Utility Evidence
- Disk Utility Quiz
- Disk Utility Practical Answers
- System Evidence: Disk Utility Saved List
- Practical 21A Disk Utility Saved List
- Practical 21B Disk Utility Saved List Evidence
- Disk Utility Saved List Quiz
- Disk Utility Saved List Practical Answers
- System Evidence: Attached USBs
- Practical 22A Attached USBs
- Practical 22B Attached USB Evidence
- Attached USB Quiz
- Attached USB Practical Answers
- System Evidence: Deleted Users
- Practical 22C Deleted Users
- Practical 22D Deleted Users Evidence
- Deleted Users Quiz
- Deleted Users Practical Answers
- Virtual Machines: Parallels
- Practical 23A Parallels
- Practical 23B Parallels Evidence
- Parallels Quiz
- Parallels Practical Answers
- Virtual Machines: Virtual Box
- Practical 24A Virtual Box
- Practical 24B Virtual Box Evidence
- Virtual Box Quiz
- Virtual Box Practical Answers
- Web Browsers: Safari
- Practical 25A Safari
- Practical 25B Safari Evidence
- Safari Quiz
- Safari Practical Answers
- Web Browsers: Firefox
- Practical 26A Firefox
- Practical 26B Firefox Evidence
- Firefox Quiz
- Firefox Practical Answers
- Web Browsers: Chrome
- Practical 27A Chrome
- Practical 27B Chrome Evidence
- Chrome Quiz
- Chrome Practical Answers
- Web Browsers: Chromium
- Practical Chromium
- Practical Chromium Evidence
- Chromium Quiz
- Advanced Analysis: Data Destruction
- Practical 28A Data Destruction
- Practical 28B Data Destruction Evidence
- Data Destruction Quiz
- Data Destruction Practical Answers
- Advanced Analysis: GEO Tags
- Practical 29A GEO Tags
- Practical 29B GEO Tag Evidence
- GEO Tag Quiz
- GEO tag Practical Answers
- Advanced Analysis: Online Accounts
- Practical 30A Online Accounts
- Practical 30B Online Accounts Evidence
- Online Accounts Quiz
- Online Accounts Practical Answers
- Advanced Analysis: WhereFrom
- Practical 31A WhereFrom
- Practical 31B WhereFrom Evidence
- WhereFrom Quiz
- WhereFrom Practical Answers
- Online Storage: Dropbox
- Practical 32A Dropbox
- Practical 32B Dropbox Evidence
- Dropbox Quiz
- Dropbox Practical Answers
- Documents: Document Files
- Practical 33A Document Files
- Practical 33B Document Files Evidence
- Document Files Quiz
- Document Files Practical Answers
- Apple Maps
- Practical 34A Apple Maps
- Practical 34B Apple Maps Evidence
- Apple Maps Quiz
- Apple Maps Practical Answers
- Peer-to-Peer Applications
- Practical 35 P2P Introduction
- Practical 35 Torrent Files
- Practical 35 BitTorrent
- Practical 35 uTorrent
- Practical 35 Vuze
- Practical 35 Frostwire
- Practical 35 Questions
- Practical 35E P2P Evidence
- P2P Quiz
- P2P Practical Answers
- Multimedia Files & iPhoto
- Multimedia Files & iPhoto
- Practical 36 D Multimedia Evidence
- Multimedia Quiz
- Multimedia Practical Answers
- Global Searches
- Global Searches
- Global Search Evidence
- Global Search Quiz
- Global Search Practical Answers
- RECON Timelines
- Global Timelines
- File Timelines
- Global Timeline Questions
- Global Timeline Evidence
- Timeline Quiz
- Global Timeline Practical Answers
- RECON Live! Automated Live Imager
- Using Automated Live Imager
- RECON Live! - Volatile Data Plugins
- Introduction & Setup
- System Uptime & Mounted Volumes
- Opened Files & Running Processes
- System Profile
- Logged Users & Active Networks
- Volatile Data Plugins Quiz
- RECON Live! - File Search
- Introduction & Setup
- Signature Database
- File Name Database
- Keyword Database
- File Search Results
- File Search Quiz
- RECON Live! - RAM Extraction and Password Extraction
- Password Extractions
- RAM Extractions
- Time Machine Volumes
- Processing Time Machine Volumes
- Global Reports
- Creating Global Reports
- Global Reports Quiz
- Updating RECON
- How to update RECON
- Conclusion
- Thank you & Final Thoughts