BlackBag informs about the latest developments as well as about encryption of the Apple File System (APFS).
The BlackBag Technologies 1-day session is designed to show best practice when acquiring an APFS image from a MacOS computer and highlight the problems examiners may face with Apples latest technology.
The session will also cover the use of BlackLight, a comprehensive forensic analysis tool that is designed to help investigators conduct digital forensic examinations on all four major platforms.
At the conclusion of the session, attendees will have a comprehensive understanding of how to use BlackLight to process evidence from MacOS (including Snapshots and Spotlight), Windows OS, iOS (including ingestion of GrayKey & Cellebrite Physical examinations), Android, Physical Memory and Data Production Sets.
All attendees will receive a 30-day trial licence to see for themselves why so many people are switching to BlackLight as their primary forensics tool.
09:30 Start of the event
09:40 Changes to Apple Security - Growing requirement for onsite acquisitions using MacQuisition
11:30 Importing the Image into BlackLight - system enhancements and recommendations
12:00 Lunch break
01:30 Examinations in BlackLight including Apple Snapshots and APFS
03:00 Roadmap overview and industry feedback
03:30 (app.) End of the event
21.08.2018, Markus Mosca