Introduction
This past May, I had the honor of representing Champlain College at Enfuse 2018 in Las Vegas, Nevada. Enfuse is an annual conference that presents a variety of seminars and labs to showcase concepts and information in categories such as eDiscovery, IoT forensics, incident response, and data governance, to name a few.
Macintosh Examinations Review
The session I most enjoyed was Macintosh Examinations. This session was orchestrated by OpenText Training Instructor and Curriculum Developer, Simon Key. Key’s session focused on document artifacts and examination techniques, especially those not typically used by examiners. He provided us with EnScripts to view Plist files and SQLite database files, which allowed us to apply the concepts learned in the session to a sample investigation using EnCase. Forensic tools traditionally have a focus on Windows environments, therefore additional work is necessary in a Mac examination. Simon conducted one of those classes that appealed to a broad audience across all skill levels. He reminded us that forensics is not always turn key; there may be additional work required, specifically when tasked with investigating a Mac environment. Simon also reminded us not to be afraid to investigate in untraditional places in addition to more common ones. I found Key’s material to be very informative and applicable to future investigations.
Conclusion
EnFuse is such an amazing conference, I was able to attend multiple classes all in different areas of focus! Not to mention extensive networking with new and familiar faces. EnFuse is more than a “tech” conference; it’s truly an experience all professionals should take part in at some point in their careers. I thank OpenText and Champlain College for providing me with the opportunity to attend once again.I hope I can have more experiences like this in the coming year!
To learn more about the LCDI, take a look at our Facebook and Twitter pages or send an email to lcdi@champlain.edu!