Difference between pages "Training Courses and Providers" and "AppleDouble header file"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (moved Scheduled Training Courses to Training Courses and Providers: Re-organize data more effectively)
 
(New page: A separate file in a filesystem containing the Apple resource fork for a related data file, developed by Apple for A/UX and therefore compatible with other filesystems including thos...)
 
Line 1: Line 1:
This is the list of Training Providers, who offer training courses of interest to practitioners and researchers in the field of Digital Forensics.   Conferences which may include training are located on the [[Upcoming_events]] page.
+
A separate file in a filesystem containing the [[ Apple resource fork ]] for a related data file, developed by Apple for A/UX and therefore compatible with other filesystems including those mounted remotely. They are heavily used under [[ Mac OS X ]].
  
<b>PLEASE READ BEFORE YOU EDIT THE LIST BELOW</b><br>
+
This file is named the same as the data file, with "<code>._</code>" prepended to the original nameThese header files are automatically included in ZIP files under a hierarchy starting with "<code>__MACOSX</code>" when utilizing the Finder's "Archive as..." function.
Some training providers offer on-going training courses that are available in an on-line "any time" format. Others have regularly scheduled training that is the same time each monthOthers have recurring training but are scheduled at various times throughout the year. Providers training courses should be listed in alphabetical order, and should be listed in the appropriate section.  Non-Commercial training is typically offered by governmental agencies or organizations that directly support law enforcement.  Tool Vendor training is training offered directly by a specific tool vendor, which may apply broadly, but generally is oriented to the vendor's specific tool (or tool suite). Commercial Training is training offered by commercial companies which may or may not be oriented to a specific tool/tool suite, but is offered by a company other than a tool vendor.
+
  
<i>Some training opportunities may be <u>limited</u> to <b>Law Enforcement Only</b> or to a specific audience.  Such restrictions should be noted when known.</i>
+
== References ==
== On-going / Continuous Training ==
+
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
|- style="background:#bfbfbf; font-weight: bold"
+
! width="40%"|Title
+
! width="20%"|Date/Location
+
! width="40%"|Website
+
|-
+
|- style="background:pink;align:left"
+
! DISTANCE LEARNING
+
|-
+
|Basic Computer Examiner Course - Computer Forensic Training Online
+
|Distance Learning Format
+
|http://www.cftco.com
+
|-
+
|Linux Data Forensics Training
+
|Distance Learning Format
+
|http://www.crazytrain.com/training.html
+
|-
+
|SANS On-Demand Training
+
|Distance Learning Format
+
|http://www.sans.org/ondemand/?portal=69456f95660ade45be29c00b0c14aea1
+
|-
+
|Champlain College - CCE Course
+
|Online / Distance Learning Format
+
|http://extra.champlain.edu/cps/wdc/alliances/cce/landing/
+
|-
+
|Las Positas College
+
|Online Computer Forensics Courses
+
|http://www.laspositascollege.edu
+
|-
+
|- style="background:pink;align:left"
+
!RECURRING TRAINING
+
|-
+
|MaresWare Suite Training
+
|First full week every month<br>Atlanta, GA
+
|http://www.maresware.com/maresware/training/maresware.htm
+
|-
+
|Evidence Recovery for Windows Vista&trade;
+
|First full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for Windows Server&reg; 2003 R2
+
|Second full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Evidence Recovery for the Windows XP&trade; operating system
+
|Third full week every month<br>Brunswick, GA
+
|http://www.internetcrimes.net
+
|-
+
|Computer Forensics Training and CCE&trade; Testing for Litigation Support Professionals
+
|Third weekend of every month(Fri-Mon)<br>Dallas, TX
+
|http://www.md5group.com
+
|-
+
|}
+
==NON-COMMERCIAL TRAINING==
+
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
|- style="background:#bfbfbf; font-weight: bold"
+
! width="40%"|Title
+
! width="40%"|Website
+
! width="20%"|Limitation
+
|-
+
|Defense Cyber Investigations Training Academy (DCITA)
+
|http://www.dc3.mil/dcita/dcitaAbout.php
+
|Limited To Certain Roles within US Government Agencies[http://www.dc3.mil/dcita/dcitaRegistration.php (1)]
+
|-
+
|Federal Law Enforcement Training Center
+
|http://www.fletc.gov/training/programs/computer-financial-intelligence/technical-operations
+
|Limited To Law Enforcement
+
|-
+
|MSU National Forensics Training Center
+
|http://www.security.cse.msstate.edu/ftc
+
|Limited To Law Enforcement
+
|-
+
|IACIS
+
|http://www.cops.org/training
+
|Limited To Law Enforcement and Affiliate Members of IACIS
+
|-
+
|SEARCH
+
|http://www.search.org/programs/hightech/calendar.asp
+
|Limited To Law Enforcement
+
|-
+
|National White Collar Crime Center
+
|http://www.nw3c.org/ocr/courses_desc.cfm
+
|Limited To Law Enforcement
+
|-
+
|}
+
  
==TOOL VENDOR TRAINING==
+
; http://users.phg-online.de/tk/netatalk/doc/Apple/v1/
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: from "A/UX Toolbox: Macintosh ROM Interface manual", Chapter 6 File Systems and File Formats
|- style="background:#bfbfbf; font-weight: bold"
+
: identifies the magic number <code>0x00051607</code> for AppleDouble files as the first 4 bytes in the file
! width="40%"|Title
+
! width="40%"|Website
+
! width="20%"|Limitation
+
|-
+
|AccessData (Forensic Tool Kit FTK)
+
|http://www.accessdata.com/courses.html
+
|-
+
|ASR Data (SMART)
+
|http://www.asrdata.com/training/
+
|-
+
|BlackBag Technologies (Macintosh Forensic Suite and MacQuisition Boot Disk)
+
|http://www.blackbagtech.com/products/training.htm
+
|-
+
|Cellebrite (UFED)
+
|http://www.forwarddiscovery.com
+
|-
+
|CPR Tools (Data Recovery)
+
|http://www.cprtools.net/training.php
+
|-
+
|e-fense, Inc. (Helix3 Pro)
+
|http://www.e-fense.com/training/index.php
+
|-
+
|Guidance Software (EnCase)
+
|http://www.guidancesoftware.com/training/course_schedule.aspx
+
|-
+
|Nuix (eDiscovery)
+
|http://www.nuix.com.au/eDiscovery.asp?active_page_id=147
+
|-
+
|Paraben (Paraben Suite)
+
|http://www.paraben-training.com/training.html
+
|-
+
|Software Analysis & Forensic Engineering (CodeSuite)
+
|http://www.safe-corp.biz/training.htm
+
|-
+
|Technology Pathways(ProDiscover)
+
|http://www.techpathways.com/DesktopDefault.aspx?tabindex=6&tabid=9
+
|-
+
|SubRosaSoft (MacForensicsLab)
+
|http://www.macforensicslab.com/ProductsAndServices/index.php?main_page=index&cPath=2
+
|-
+
|WetStone Technologies (Gargoyle, Stego Suite, LiveWire Investigator)
+
|https://www.wetstonetech.com/trainings.html
+
|-
+
|X-Ways Forensics (X-Ways Forensics)
+
|http://www.x-ways.net/training/
+
|-
+
|}
+
  
==COMMERCIAL TRAINING==
+
; http://en.wikipedia.org/wiki/AppleDouble
{| border="0" cellpadding="2" cellspacing="2" align="top"
+
: background and additional information
|- style="background:#bfbfbf; font-weight: bold"
+
 
! width="40%"|Title
+
; http://www.ietf.org/rfc/rfc1740.txt
! width="40%"|Website
+
: MIME Encapsulation of Macintosh files - MacMIME
! width="20%"|Limitation
+
 
|-
+
[[Category:File Formats]]
|Computer Forensic Training Center Online (CFTCO)
+
|http://www.cftco.com/
+
|-
+
|CCE Bootcamp
+
|http://www.cce-bootcamp.com/
+
|-
+
|Dera Forensics Group
+
|http://www.deraforensicgroup.com/courses.htm
+
|-
+
|e-fense Training
+
|http://www.e-fense.com/training/index.php
+
|-
+
|Forward Discovery, Inc.
+
|http://www.forwarddiscovery.com
+
|-
+
|Hoffmann Advanced Forensic Sessions
+
|http://en.hoffmannbv.nl/index.cfm/t/Hoffmann_Advanced_Forensic_Sessions/vid/990B3B29-FD6A-6F79-58B3C841381DB7AF
+
|-
+
|H-11 Digital Forensics
+
|http://www.h11-digital-forensics.com/training/viewclasses.php
+
|-
+
|High Tech Crime Institute
+
|http://www.gohtci.com
+
|-
+
|Infosec Institute
+
|http://www.infosecinstitute.com/courses/security_training_courses.html
+
|-
+
|ManTech Computer Security Training
+
|http://www.mantech.com/msma/isso.asp
+
|-
+
|Mobile Forensics, Inc
+
|http://mobileforensicsinc.com/
+
|-
+
|NTI (an Armor Forensics Company)
+
|http://www.forensics-intl.com/training.html
+
|-
+
|Security University
+
|http://www.securityuniversity.net/classes.php
+
|-
+
|Steganography Analysis and Research Center (SARC)
+
|http://www.sarc-wv.com/training.aspx
+
|-
+
|SysAdmin, Audit, Network, Security Institute (SANS)
+
|http://forensics.sans.org
+
|-
+
|<s>Vigilar</s>Company Re-organization - Intense School closed
+
|<s>www.vigilar.com/training/</s> http://www.ashimmy.com/2009/12/message-from-barry-on-intense-school.html
+
|-
+
|Zeidman Consulting (MCLE)
+
|http://www.zeidmanconsulting.com/speaking.htm
+
|-
+
|}
+

Revision as of 03:27, 4 September 2008

A separate file in a filesystem containing the Apple resource fork for a related data file, developed by Apple for A/UX and therefore compatible with other filesystems including those mounted remotely. They are heavily used under Mac OS X .

This file is named the same as the data file, with "._" prepended to the original name. These header files are automatically included in ZIP files under a hierarchy starting with "__MACOSX" when utilizing the Finder's "Archive as..." function.

References

http://users.phg-online.de/tk/netatalk/doc/Apple/v1/
from "A/UX Toolbox: Macintosh ROM Interface manual", Chapter 6 File Systems and File Formats
identifies the magic number 0x00051607 for AppleDouble files as the first 4 bytes in the file
http://en.wikipedia.org/wiki/AppleDouble
background and additional information
http://www.ietf.org/rfc/rfc1740.txt
MIME Encapsulation of Macintosh files - MacMIME