Prerequisites
Before any forensic acquisition you must document the evidence
See my Cybrary course: “Evidence Handling: Do it the Right Way”
See my Cybrary course: “Basic Evimetry Deadboot Forensic Acquisition: Wired & Local”
A full-featured, evaluation copy of Evimetry
An evaluation copy of Mount Image Pro
Internet connected computer
An encrypted Mac computer
A USB thumbdrive for dead booting
A storage drive (USB3 External)
Course Goals
By the end of this course, students should be able to:
How to identify a BitLocker’d or FileVault’d disk by signature
Acquire a FileVault’d Mac with Evimetry
Use Mount Image Pro to decrypt Windows and Mac encrypted volumes