Northern California Chapter (9am - Noon PT) [In-Person]

Description

Accept emails from no-reply@zoom.us to get your personalized registration link.  

HTCIA Northern California Chapter Meeting [In-Person ONLY]

Event Title:
macOS Acquisitions with Open-Source Tools

Presented by:
Derek Eiri, Cybersecurity Analyst

Derek Eiri is a cybersecurity analyst at a non-profit integrated healthcare system. In this role, he participates in incident response activities and enhances organizational readiness to collect, examine, analyze, and report on data to minimize disruptions to patient care. Previously, Derek held roles in healthcare compliance, privacy, and information security. He was responsible for investigating allegations of unauthorized access or disclosure of protected health information, detecting and preventing fraud, waste, and abuse, and assessing third-party vendors and technology risks. Derek also volunteers as the Secretary for HTCIA's Northern California chapter. In his free time, he tends to chickens, cleans corgi hair off of _everything_, and spends quality time with family.

Presentation Description:
An overview acquiring data from macOS devices with Fuji.

1) Brief overview on why macOS acquisitions are different
2) What is Fuji
3) How to use Fuji
4) Demonstration booting Fuji in Recovery Mode

"Fuji is a free, open-source program for performing forensic acquisition of Mac computers. It should work on any modern Intel or Apple Silicon device, as it leverages standard executables provided by macOS.

Fuji performs a so-called live acquisition (the computer must be turned on) of logical nature, i.e. it includes only existing files. The tool generates a DMG file that can be imported in several digital forensics programs."

https://github.com/Lazza/Fuji