Nordic Computer Forensic Investigators - Module 3i Macintosh Forensics, Advanced

Study information

• Your learning outcomes

  The aim of this program is to ensure that the quality of computer forensic investigation is of a high level, guaranteeing legal protection and the right to privacy.

  General competence

  After completion of the module candidates will be able to:

  • perform professional tasks in the role of digital forensic investigator with increased insight and confidence
  • see the role of digital forensics in a broader perspective during an investigation
  • identify ethical and legal issues during investigation

  
  Knowledge

  After completion of the module candidates will have knowledge of:

  • recognising more advanced and complex traces in macOS and iOS architecture
  • describing and identifying structures in file systems used by macOS and iOS

  
  Skills

  After completion of the module candidates will be able to:

  • use software tools to perform Live Data Forensics according to basic principles and best practice
  • interpret various advanced artefacts in macOS and iOS
  • use of the command line interface in macOS to solve investigational challenges
  • interpret advanced artefacts in Apple file systems

• Admission criteria

  The primary target group is police staff in the Nordic countries whose main task is handling and investigating digital evidence. It is a prerequisite that participants are selected in accordance with local competency plans.

  Employees in other International police services or governmental agencies who work, or will work, with digital evidence are also eligible to apply. 

  Admission criteria Applicants for module 3i must:

  • be employed by a national or local governmental agency
  • have passed NCFI Module 3D Macintosh Forensics, Basic

  
  Foreign applicants are only entitled to apply if:

  • the applicant's country has a partnership with PHS
  • they have been selected in accordance with the partner's competency plans

• Practical information

  This module is delivered on-line as a part-time education, and the students are expected to complete the program within one semester. The approximate duration of the module is 210 hours of study.

  The student needs to pass a number of course requirements in order to sit the exam.

  The module is concluded with a two day take-home practical exam. Students will be graded on a scale from A – F. A – E are passing grades and F is a failing grade.

• Schedule for tuition and assesment

  Online tuition.

  Starting autumn 2021.

  Home exam: December 2021.

   

• Tuition fee

  A semester fee is required.

  An external student is defines as a student from another Nordic coutry, or an agency outside the police service (including police special agencies). The tuition fee is not applicable to students coming from insttitutions which have a reciprocal agreement with NPUC, or an agreement involving contributions to the study programme. The student fee is NOK 15 000,-.

• Contact information

  Academic questions

  Academic inquiries should be adressed to e-mail: cybercrime@phs.no.

  Questions relating to the admissions procedure

  Questions regarding the admission process (deadline, application process, documentation) should be adressed to e-mail: opptakevu@phs.no.

  Administrative questions about the study programme

  If you do not find what you are looking for, please send an email to: studiekontoret.oslo@phs.no

The course is one of a series of modules in the NCFI Programme

• All modules

  Nordic Computer Forensic Investigators - Introduction to Digital Policing

  Nordic Computer Forensic Investigators - Module 1 Core Concepts in Digital Investigation and Forensics

  Nordic Computer Forensic Investigators - Module 2A Advanced Computer Forensics

  Nordic Computer Forensic Investigators - Module 2B Online Investigation

  Nordic Computer Forensic Investigators - Module 2C Network Forensics and Cybercrime

  Nordic Computer Forensic Investigators - Module 2D Mobile Extraction and Artifacts

  Nordic Computer Forensic Investigators - Module 3A Forensic Tool Development

  Nordic Computer Forensic Investigators - Module 3B Linux Artifacts

  Nordic Computer Forensic Investigators - Module 3C Linux as an Investigative Platform

  Nordic Computer Forensic Investigators - Module 3D Macintosh Computer Forensics

  Nordic Computer Forensic Investigators - Module 3E Windows Forensics

  Nordic Computer Forensic Investigators - Module 3F Memory Investigation

  Nordic Computer Forensic Investigators - Module 3i Macintosh Forensics, Advanced

  Nordic Computer Forensic Investigators - Module 3K Report Generation Visualisation