Apple-device Forensics

-OSX and iOS artifacts
-HFS+
-Live forensics of Apple devices
-Apple hardware artifacts
-Ethical dilemmas
-Crime prevention policing

Knowledge
-After completing the course the candidate possesses knowledge of:
-Identification and proper handling of various Apple-based devices
-Methods and techniques for locating relevant trace evidence
-Legal and ethical issues

Skills
-After completing the course the candidate can:
-Identify various Apple devices
-Evaluate and apply relevant methods, techniques and tools in all phases of investigation of electronic traces on Apple-based devices
-Mastering the command line interface of the operating system
-Identify and manage data and hardware that is locked
-Advise on management of Apple-based devices

General Competence
-After completing the course the candidate can:
-Emerge with greater insight and confidence in the professional role
-Show personal responsibility for tasks in the investigation of electronic evidence
-Identify and evaluate ethical dilemmas in work performance
-See digital forensics in a broader proactive and reactive context

-Lectures
-E-learning
-Assignments
-Independent study
-Essay/Article writing

Additional information:jon:
-The course will be made accessible for remote students. It is organized as a web-based, online course where students can choose their own start time and follow their progress within the semester. The course program is estimated to be approx. 280 hours. The teaching methods emphasis a student-centered learning via Internet, including 10 online, on-demand lectures and the use of a virtual computer lab. In this course, students will build their forensic toolkit from scratch, which also takes place in a virtual environment. The working methods of the course is intended to provide students with good learning outcomes, and in particular highlighted the link between theory and practice. The students will work on an essay/article that is part of the assessment.
-A distributed online learning plattform at PHS (the Norwegian Police University College) is used in the administration and implementation of the course (PHS´s Canvas/PingPong).

The following course requirements must be met and approved before students can take the exam:
-Up to four assignments related to specific topics

The course responsibble and point of contact at PHS: Kurt-Helge Hansen. PHS offers a similar course in Apple/Macintosh-Device Forensic, possible to sign in before enrollment to the master program. Students who have passed the PHS course can apply for replecement of IMT4504-PHS when enrolled to MISEB.