|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/surviving-digital-forensics-understanding-os-x-time-stamps/
课程评论：没有评论
**课程名称：** 生存数字取证：理解OS X时间戳 **课程概述：** 本课程隶属于“生存数字取证”系列，旨在帮助学员深入理解OS X时间戳，提升Mac设备勘查能力。课程采用“实践出真知”的学习方式。 **课程内容：** 课程首先简要介绍Apple视角下的OS X时间概念，随后通过一系列验证练习，深入探讨用户活动如何实际影响OS X时间戳。学习过程强调实操性，将利用Mac设备已安装的应用程序进行。无论您是Mac勘查专家还是初学者，都将受益匪浅。 本课程将教授您真实可应用的计算机取证技能，适用于所有版本的OS X。您不仅会了解OS X时间戳，还将学习一种能够回答未来众多日期和时间相关问题的方法。 **课程大纲：** 1. 引言与SDF系列欢迎 2. 本课程重点内容 3. 如何最大化利用本课程 4. OS X日期和时间的细节 5. 用户视角下的时间 6. Apple元数据时间戳与MDLS命令 7. 延迟问题 8. 验证练习：新建文件 9. 验证练习：修改文件 10. 验证练习：同一卷中的文件移动 11. 验证练习：移动文件到另一卷 12. 验证练习：访问文件 13. 验证练习：下载文件 14. 验证练习：删除文件 15. 结果总结 16. 关于时间属性痕迹的思考 17. 结论与最终想法
Welcome to the Surviving Digital Forensics series. This class is focused on helping you get a better understanding of OS X Time Stamps and to become a better Mac examiner. As with previous SDF classes you will learn by doing. The class begins with a brief overview of OS X time - as Apple sees it - then we will get into a number of validation exercises to see how user activity really affects Apple time stamps. Learning is hands on and we will use applications already installed on your Mac to do so. Expert and novice Mac examiners alike will gain from this class. Since we are doing it the SDF way we are going to teach you real computer forensic skills that you can apply to all versions of OS X. Therefore you are not just going to learn about OS X timestamps but learn a method you can use to answer many date and time questions that may come up in the future. Class Outline 1. Introduction and Welcome to the SDF series 2. What this class is all about 3. How to get the most of this class 4. The finer points of OS X dates and times 5. Time from a User's point-of-view 6. Apple metadata timestamps & the MDLS command 7. Latency issues 8. Validation Exercise: New file 9. Validation Exercise: Modified file 10. Validation Exercise: Moving file within same volume 11. Validation Exercise: Moving file to a different volume 12. Validation Exercise: Accessing a file 13. Validation Exercise: Downloading a file 14. Validation Exercise: Deleting a file 15. Summary of findings 16. Thoughts on time attribute artifacts 17. Conclusion & final thoughts
