Buying for a Team? Gift This Course
Wishlisted Wishlist

Please confirm that you want to add Surviving Digital Forensics: Imaging a Mac Fusion Drive to your Wishlist.

Add to Wishlist

Surviving Digital Forensics: Imaging a Mac Fusion Drive

Helping you sharpen your computer forensic skills
4.2 (15 ratings)
Instead of using a simple lifetime average, Udemy calculates a course's star rating by considering a number of different factors such as the number of ratings, the age of ratings, and the likelihood of fraudulent ratings.
98 students enrolled
Last updated 10/2015
30-Day Money-Back Guarantee
  • 1 hour on-demand video
  • 2 Articles
  • Full lifetime access
  • Access on mobile and TV
  • Certificate of Completion
Have a coupon?
What Will I Learn?
Image a Mac using just a Mac and freely available tools
Learn how to install DCFLDD on a Mac
Learn how to use DCFLDD in Terminal
Image Mac Fusion drives
Apply different hashing algorithms to the imaging process
Create segmented image files
Target image partitions only
View Curriculum
  • All you need is a Mac running OS 10.7+ (OS 10.10 recommended) and the desire to learn.

All courses may now be found at SUMURI.COM. This course will remain live in UDEMY for existing students.

Welcome to the Surviving Digital Forensics series. This series is focused on helping you become a better computer forensic examiner by teaching core computer forensic skills - all in about one hour. In this class you will learn how to image a Mac using only a Mac and freely available software. This will give you not only an additional imaging option but also provide you a solution for imaging Mac Fusion drives.

As with previous SDF classes you will learn by doing. The class begins with a brief overview of the issue at hand. Then we set up our forensic systems and off we go. Learning is hands on and we will use low cost and no cost computer forensic tools to do so.

Expert and novice computer forensic examiners alike will gain from this class. Since we are doing it the SDF way we are going to teach you real computer forensic skills that you can apply using our method or customize to meet your needs. We cover basic imaging as well as some additional options you may need such as, splitting an image, using different hash algorithms, imaging partitions and more.

Class Outline

1. Introduction and Welcome to the SDF series

2. What this class is all about

3. How to get the most of this class

4. The problem and the solution

5. Getting your forensic system setup

6. Imaging steps download

7. Turning off Disk Arbitration

8. Identifying your evidence in Terminal

9. Imaging with DCFLDD

10. Lock your DMG file

11. DCFLDD breakdown

12. Getting the DCFLDD version

13. Using different hash algorithms

14. Splitting your image

15. Changing the image file extensions of your image segments

16. Imaging partitions

17. Imaging Mac Fusion drives

18. Mac imaging quiz

18. Thank you & final thoughts

A Mac running OS 10.9+ is required for this course. If you are running 10.7 or 10.8 you likely will be okay, but a more up-to-date platform is recommended. The forensic tools we use are all freely available, so beyond your operating system all you need is the desire to become a better computer forensic examiner.

Who is the target audience?
  • Computer forensic analysts
  • IT professionals
  • Students
Students Who Viewed This Course Also Viewed
Curriculum For This Course
Expand All 20 Lectures Collapse All 20 Lectures 49:28
4 Lectures 14:35

Welcome to the Surviving Digital Forensics Series!

Preview 04:27

Let's talk about what this class is all about and what you will get out of it.

Preview 03:47

Here a few tips to get the most out of this training.

Preview 03:51

Let's look at the issue at hand and how we are going to solve it.

The problem and the solution
Getting Set Up
3 Lectures 04:55

In this lesson I will walk you through installing the freely available forensic tools we will be using.

Getting you forensic system set up

Imaging Steps Download

How to mount your evidence storage disk after you turn Disk Arbitration off.

Mounting your Evidence Storage Drive
12 Lectures 28:00

You may use Disk Arbitration as a software write block so long as you validate it! In this next section I go over the steps of turning off Disk Artbitration.

Turning off Disk Arbitration

Since we are working in Terminal you need a way to identify your local disks from your evidence disks. This next sections walks you through the steps to do it.

Identifying your evidence disk in Terminal

Now let's get to it and create an image.

Imaging with DCFLDD

Remember to lock your DMG file to keep it in read only mode.

Lock you DMG file

In this section I break down DCFLDD so you better understand the command. This comes in handy if you have to explain it.

DCFLDD Breakdown

Many examiners need to document the version of the tool they use. In this section I will show you how to identify the version of DCFLDD you are using.

Getting the DCFLDD Version

MD5 is old fashion, let's adjust our command so we can hash using different algorithms and hash with multiple algorithms at once.

Using different hash algorithms

Next up is learning how to segment your image file. I will show you how to set it up and how to customize it.

Splitting your image

In this module I will show you how to change the file extension of your segmented image file.

Changing the file extensions of your image segments

Sometimes you do not want to image the entire disk. Rather, you just need to image a certain partition on the disk. I show you how to do that next.

Imaging partitions

If you are imaging a Mac Fusion drive, or any Mac for that matter, an option is to place it into target disk mode and image it that way. In this section I will walk you through the steps.

Imaging a Mac Fusion Drive

This section teaches you how to image the pieces of a Mac Fusion drive and then reassemble them on a forensic Mac to be recombined into a new image file.

New Method! - Imaging & reassembling a Fusion Drive

Mac Imaging Quiz
6 questions
1 Lecture 01:44

Thanks for joining me in another edition of the Surviving Digital Forensics series. I hope you enjoyed the class!

Check out other classes of the SDF series at

Follow me on Twitter @LeclairDF to get the latest happenings of the SDF series.

Check out our Blog at

Check out our Youtube channel

Thank you and final thoughts
About the Instructor
4.1 Average rating
289 Reviews
2,245 Students
15 Courses
Computer Forensic Analyst

Over twelve years of experience as a Computer Forensic Analyst, author and developer of computer forensic training and analysis tools. Specialties include: Windows forensics, Mac forensics, iOS forensics, Mac Server forensics & mobile device forensics. Creator of the "Surviving Digital Forensics" series and part of SUMURI's RECON for Mac OS X development team.

Certifications include: CFCE, CISSP, CCE, EnCE, A+, Network+

Regularly instruct law enforcement, government and corporate investigators both nationally and internationally in computer forensics.

Report Abuse