Module 1

Before the course

1. 1.(W00) Course Instructions
2. 2.(W37M01) MacOS Anti-forensics: The Introduction
3. 3.(W37M02) MacOS Anti-forensics: Releases & Components
4. 4.(W37M03) People working in macOS anti-forensics & Wrap-up
5. 5.(W37M04) MacOS components and anti-forensics

Module 2

Module 1

1. 1.(W37M05) Introduction to Module 1
2. 2.(W37M06) Introduction to macOS anti-forensics
3. 3.(W37M07) Categories of macOS anti-forensics
4. 4.(W37M08) macOS components critical for anti-forensics
5. 5.(W37M09) Category - Data Hiding
6. 6.(W37M10) Category - Artefact wiping
7. 7.(W37M11) Category - Trail Obfuscation
8. 8.(W37M12) Category - Attacks Against Forensics
9. 9.(W37M13) Category - Case Study - the Marble framework
10. 10.(W37M14) Privacy protection in Safari, Part 1
11. 11.(W37M15) Privacy protection in Safari, Part 2

Module 3

Module 2

1. 1.(W37M16) Tooling introduction - data hiding
2. 2.(W37M17) Data hiding - SilentEye walkthrough
3. 3.(W37M18) Data hiding - SilentEye Overview
4. 4.(W37M19) Data Hiding - SilentEye - Pros and Cons
5. 5.(W37M20) Data hiding experiments: SilentEye - lab setup
6. 6.(W37M21) SilentEye - Steganography without encrytpion
7. 7.(W37M22) SilentEye: Steganography with encryption
8. 8.(W37M23) SilentEye: File in an image steganography without encryption
9. 9.(W37M24) SilentEye: File in an image steganography with encryption
10. 10.(W37M25) Data hiding: Intro to Filevault
11. 11.(W37M26) Data hiding: enable Filevault
12. 12.(W37M27) Data hiding: disable Filevault
13. 13.(W37M28) Datahiding: Filevault Pros and Cons
14. 14.(W37M29) What is artefact wiping?
15. 15.(W37M30) Artefact wiping with Disk Utility
16. 16.(W37M31) Experiments with Disk Utility
17. 17.(W37M32) Diskutulity Pros and Cons
18. 18.(W37M33) Intro to Disk Utility debug model
19. 19.(W37M34) Experiments with Disk Utility Debug
20. 20.(W37M35) Disk Utility Debug Pros and Cons
21. 21.(W37M36) What is trail obfuscation?
22. 22.(W37M37) Trail obfuscation experiments
23. 23.(W37M38) Trail obfuscation - experiment
24. 24.(W37M39) Tunnelblick and obfsproxy - Lab setup
25. 25.(W37M40) Tunnelblick walkthrough
26. 26.(W37M41) Trail obfuscation - Get the IP address
27. 27.(W37M42) Tunnelblick - Pros and Cons
28. 28.(W37M43) Attacks against forensics - introduction
29. 29.(W37M44) What is counterforensics?
30. 30.(W37M45) What is CyberChef?
31. 31.(W37M46) Lab Setup - CyberChef
32. 32.(W37M48) CyberChef walkthrough
33. 33.(W37M49) CyberChef operation DateTime
34. 34.(W37M50) CyberChef operation zip/unzip
35. 35.(W37M51) CyberChef operation: hashing
36. 36.(W37M52) How to work with a recipe
37. 37.(W37M53) CyberChef - Morse Code
38. 38.(W37M54) Cyberchef: dataformat
39. 39.(W37M55) CyberChef - pros and cons
40. 40.(W37M47) Information on module 2 examination
41. 41.(W37M00) Usecases - Addendum

Module 4

Module 3

1. 1.(W37M00) Module 3 Introduction
2. 2.(W37M56) Forensics vs Anti-Forensics Arms Race
3. 3.(W37M57) Anti-Forensics - macOS vs Windows
4. 4.(W37M58) Windows Anti-Forensic Tools - BitLocker
5. 5.(W37M59) Case Study - IoT
6. 6.(W37M60) Case study - fileless malware
7. 7.(W37M61) Effectiveness of Anti-Forensics Software
8. 8.(W37M62) Case Study - Azure Sphere
9. 9.(W37M63) Case Study - ITP2
10. 10.(W37M64) Case-Study - Celeb Gate
11. 11.(W37M65) iOS and macOS - future plans
12. 12.(W37M00) Addendum: FAQ - Project Marzipan

Module 5

Final Exam