What You Will Learn

Digital forensic and incident response investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iOS device? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms. Dealing with these devices as an investigator is no longer a niche skill - every analyst must have the core skills necessary to investigate the Apple devices they encounter.

This consistently updated FOR518 course provides the techniques and skills necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. In addition to traditional investigations, the course presents intrusion and incident response scenarios to help analysts learn ways to identify and hunt down attackers that have compromised Apple devices.

"Again, SANS proves to provide the best technical training the market has to offer. Sarah has put together a comprehensive, coherent, challenging, and downright fun (is convivial too much?) course to attend. The FOR518 is everything I wanted it to be and so much more. I realize only now how apt a phrase "Impera Magis, Aliter Cogita" truly is: if you want to be successful at this course, embrace the command line, and abandon all ye know of Windows, because this is a different OS. I am thrilled to be taking this course and can't wait to dive even deeper into the limitless nuance MacOS & iOS forensics have to offer."

What Is macOS and iOS Forensics Analysis?

MacOS and iOS Forensic Analysis is the recovery, analysis, and interpretation of data stored on Apple devices.

Business Takeaways

Empower employees to investigate various crimes such as computer misuse, malicious device intrusions, corporate espionage, insider threats, and fraud.
Learn how various Apple data is stored and how to analyze using tool agnostic methods without the requirement for expensive commercial forensic tools.
Identify different forensic artifacts and nuances between the Apple platforms (macOS and iOS).
Understand the wealth of user related information that can show how a device was used or abused.
Learn the differences of performing forensics and security assessments when Apple devices are involved versus other industry-standard operating systems.

Skills Learned

Understand the nuances between macOS and iOS devices
Dive into how the Apple magic works between devices, and how that can help investigations
Determine the importance of each file system domain and how data is organized
Conduct temporal analysis of a system by correlating data files and log analysis
Profile how individuals used the system, including how often they used the system, what applications they frequented, and their personal system preferences
Identify remote or local data backups, disk images, or other attached devices
Find encrypted containers and FileVault volumes, understand keychain data, and crack Mac passwords
Analyze and understand macOS metadata and their importance in the Spotlight database, Time Machine, and Extended Attributes
Develop a thorough knowledge of the Safari Web Browser, Apple Mail and many more applications by looking that their internal databases
Identify communication with other users and systems though Messages, FaceTime, SSH remote login, Screen Sharing, and AirDrop
Conduct an intrusion analysis of an Apple devices for signs of compromise or malware
Understand the APFS file system and its significance with a bonus Lab to parse the APFS file system by hand, using only a reference sheet and a hex editor
Understand how the Apple Ecosystem of devices work and interact with each other. From AirTags, to VisionPro, to the Apple Watch, to HomeKit - all these Apple technologies will have artifacts on macOS and iOS devices.

Hands-On macOS and iOS Forensics Training

The hands-on portion of FOR518 is unique and especially suited to those who love to dig into the data. The labs were created to show how Apple data is stored and how to interpret it without the need for an expensive commercial utility. These labs will allow a student to get a hands-on perspective of the data that is shown in the class presentations and apply the concepts to the course dataset. The labs in this course are a major component of the learning experience and enables the student to increase their success in applying various analysis course topics after they leave the classroom.

"Labs were very accurate and relevant to the topics we were learning during class. Very entertaining, interesting and challenging."

"The exercises were complicated, but the walkthroughs and questions were easily digestible, which is hard to do! Some of the more recent classes I've taken had such complicated labs that you couldn't easily track back to a mistake. Sarah's designed the labs to be just as complicated, if not more so, while using language, and questions, to make troubleshooting so much easier."

"Really enjoyed the labs, love that it's highly encouraged to use the command line tools. Nothing against any vendor and their GUI, but my goal since starting in cyber security was to use the command line as much as possible (without being impractical). This course is a master class in that."

Syllabus Summary

Section 1: An introduction to the Apple platforms including data storage, file analysis, and data interpretation.
Section 2: Log analysis and review of various user and system settings.
Section 3: It's all about the metadata stored within multiple file system artifacts.
Section 4: Every application is different, review how each app stores it's data.
Section 5: All other things; from pattern of life analysis, to password cracking, to malware, and "one more thing!"
Section 6: The Apple Forensics Challenge, take what you learn in class and compete in a CTF-style challenge against others.

Additional Free Resources

What You Will Receive

Course ISOs loaded with dataset and tools.
MP3 audio files of the complete course lecture

Course topics

Advanced Computer Forensics Methodology
Apple Specific Acquisition and Live Response Collection
File System Data Analysis
Metadata Analysis
Recovery of Key Mac and iOS Files
Database Analysis
Volume and Disk Image Analysis
Analysis of Mac Technologies, including Time Machine, Spotlight, and FileVault
Analysis of Apple Devices including AirTags, Apple Watch, FindMy, HomeKit as they interact with the macOS and iOS counterparts
Advanced Log Analysis and Correlation
In-Depth APFS File System Examination

What Comes Next?

Depending on your current role or future plans, one of these courses is a great next step in your digital forensics and incident response journey:

Syllabus (36 CPEs)

Download PDF

Mac and iOS Essentials
Overview
This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.
Exercises
- Course Lab Setup
- Disks and Volumes
- Mount and Review Acquisitions
- Triage
- Forensic Testing
Topics
- Apple Essentials and Device Security
  Platform and Versions
  Timestamps
  File Types
  Security Concepts
- Disks and Volumes
  Disk and Volume Structures
  GPT and other partitioning schemes
  FileVault & Hardware Encryption
  Disk Images
  APFS Containers
- macOS Acquisition Tools and Methods
  Acquisition Pitfalls and Considerations
  Commercial and Free Tools
  Volatile Data
  Memory Acquisition & Analysis
- iOS Acquisition Tools and Methods
  Commercial and Free Tools
  Jailbreaks
  Acquisition Types and Differences
  Local and iCloud Backups
  Sysdiagnose Files
  Tools for Acquisition and Analysis
- Data Organization, Triage, and iCloud
  Domain Organization of Data
  Containers and Sandboxing
  iOS Backup Normalization
  Application Data Structure
  Triage Analysis
  Accounts
  iCloud
- Forensic Testing
  Device Setup
  Tools - Corellium, Free, and Open-source
  SQLite Database Queries
  Database Structures
Log Analysis, User Data, and System Configuration
Overview
Mac and iOS devices contain many system settings that can show how a device was used (or abused). A user of the device may change a specific configuration that can provide useful forensic insight. Often these configuration actions can be also found in the logs and provide historical context to create a detailed story of how the device was used.
This section focuses on system and data configurations alongside log analysis. These devices have many different types of logs each with their own method for analysis and content. The log entries can be correlated with user and system data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently.
Exercises
- Parsing System Logs
- User Artifacts and User Interface
- Volumes, Printing, and System State
- Network and Bluetooth
Topics
- Parsing System Logs
  Log Basics
  Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
  Log Configuration
  Analysis Methods and Parsing Tools
- User Account
  Deleted Users
  User Logins
  Privilege Escalation
  Most Recently Used Items (MRUs)
  NSKeyedArchiver Plist Files
  Managed Users
- User Interface
  Keyboard
  Notifications
  iOS Springboard
  macOS Finder
  Saved Application State
- Volumes
  Log and File Analysis
  Connected Devices
  Network Shares
- Printing
  Control Files
  Data Files
- System State
  Log and File Analysis
- Network
  Device Configuration
  Cellular Data
  Wi-Fi Access Point Connections
  Remote Access
  Log and File Analysis
- Bluetooth
  Device Connections
  Apple Continuity Technology
  AirDrop
  Log and File Analysis
File Systems and Related Artifacts
Overview
After a review of how APFS works, students will look at a variety of fascinating artifacts that are used by the file system and that are quite different from other operating systems students have seen in the past. This includes many artifacts that contain metadata and can provide more context into investigations.
In an additional bonus lab students will learn the building blocks of Mac and iOS forensics with a thorough deep-dive understanding of the Apple File system (APFS). Utilizing a hex editor, students will learn the basic structures of the primary file system implemented on MacOS and iOS systems.
Exercises
- Parsing APFS (Bonus)
- Disk and Volume Artifacts
- Extended Attributes
- Spotlight
- Document Versions
- FSEvents
Topics
- Volume File System Artifacts
  Overview of APFS
  Data Structures
  APFS Benefits and Caveats
  APFS Clones
  APFS Snapshots
  Artifacts Left Behind by Macs
  Differences from Various File Systems
  DS_Store Files
  APFS analysis with The Sleuth Kit (TSK)
- Extended Attributes
  Contents
  Analysis
  Forensically Useful Attributes
- Spotlight
  Indexed Items
  Analysis Methods and Tools
  Practical Queries
- Document Versions
  Versions Metadata
  Versions Database
  Generations
  Chunk Storage
- File System Events Store Database (FSEvents)
  Usage
  Parsing with Tools
  Practical Analysis
Application Data Analysis
Overview
In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.
This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.
Exercises
- Application Fundamentals
- Safari and Wallet
- Mail and Communication
- Notes, Photos, Maps
Topics
- Application Fundamentals
  Application Bundles
  Mach-O Executables
  Extensions
  Software Updates
  iOS Application Snapshots
  Permissions
- Safari Browser
  History
  Cache
  Session Data
- Wallet
  Cards
  Passes
  Transactions
- Mail
  Email Files
  Attachments
  Downloaded Items
- Communication
  Messages
  FaceTime
  Call History
  Voicemail
- Notes
  Database Analysis
  Protobufs
- Photos
  Media Analysis
  Photo Metadata
- Maps
  Database Analysis
  Protobufs
Advanced Analysis Topics
Overview
Apple systems implement some technologies that are available only to those with Mac and iOS devices. In this section, students will learn about a variety of topics that can be used in a variety of investigations. Topics such as pattern of life will detail very specific user and device activities which can determine which app was being used at precise time, how many steps did they walk, was the device unlocked, or where the device was. Other advanced topics include cracking into data hidden in encrypted containers, indicators of compromise, security enhancements, and all other Apple "things" including FindMy, AirTags, TimeMachine and more!
Exercises
- Pattern of Life
- Password Cracking
- Malware and Live Response
- One More Thing (Other Apple Technology)
Topics
- Pattern of Life
  Screen Time
  KnowledgeC
  Biomes
  Power Logs
  Application Usage
  Media Usage
  Device Status
  Health
  Location Data
- Password Cracking
  Password Shadow Files
  Cracking Passwords
  Keychains
  FileVault
  Dictionary Files
  Encrypted Disk Images
- Malware and Live Response
  Malware Examples
  File Quarantine
  XProtect
  Gatekeeper
  Notarization
  Autoruns
  Firewall Settings
  Velociraptor
- One More Thing
  Time Machine
  Apple Watch
  CarPlay
  FindMy
  AirTags
  HomeKit
  VisionPro
Mac Forensics & Incident Response Challenge
Overview
In this final course section, students will put their new All-Things-Apple forensic skills to the test by running through a real-life scenario.
Topics
- In-Depth File System Examination
- File System Timeline Analysis
- Advanced Computer Forensics Methodology
- File System Data Analysis
- Metadata Analysis
- Recovering Key Mac Files
- Database Analysis
- Volume and Disk Image Analysis
- Analysis of Apple-specific Technologies
- Advanced Log Analysis and Correlation

GIAC iOS and macOS Examiner

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

Mac and iOS File Systems, System Triage, and Application Data
Mac and iOS Incident Response, Malware, and Intrusion Analysis
Mac and iOS User Data and Timeline Analysis

More Certification Details

Prerequisites

Working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MAC hardware is required for this course. The labs cannot be performed on anything other than native MAC hardware

MANDATORY FOR518 SYSTEM HARDWARE REQUIREMENTS

16GB of RAM or more is required.
200GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Additional requirements for this course:

Apple MacOS 12 or newer is required.

MANDATORY FOR518 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"This course is designed to enable an analyst comfortable in Windows-based forensics to perform just as well on a Mac. The Mac and iOS market share is ever-increasing, and the Apple is now a popular platform for many companies and government entities. I believe a well-rounded forensic analyst is an extremely well-prepared and employable individual in a Windows forensics world. Windows analysis is the base education in the competitive field of digital forensics, but any additional skills you can acquire can set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis.

Mac and iOS forensics is truly a passion of mine that I genuinely want to share with the forensics community. While you may not work on a Mac or iOS investigation every day, the tools and techniques you learn in this course will help you with other investigations including Windows, Linux, and mobile."

- Sarah Edwards

"FOR518 is a great course for forensics people and organizations that use Mac within their environments, and the labs were really engaging. Sarah is an expert in this field and a great instructor, and she's really responsive to our comments and questions." - Ali Memarzia, Google

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

View Available Dates & Time Zones

In Person (6 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

View Available Dates & Locations

Who Should Attend FOR518?

Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of file system forensics and advanced Mac analysis.
Law Enforcement Officers, Federal Agents, and Detectives who want to master advanced computer forensics and expand their investigative skill set.
Media Exploitation Analysts who need to know where to find the critical data they need from a Mac system.
Incident Response Team Members who are responding to complex security incidents/intrusions from sophisticated adversaries and need to know what to do when examining a compromised system.
Information Security Professionals who want to become knowledgeable about MacOS and iOS system internals.
SANS FOR500, FOR508, SEC575, and FOR585 Alumni looking to round out their forensic skills.

NICE Framework Work Roles:

Cyber Defense Incident Responder (OPM 531)
Cyber Crime Investigator (OPM 221)
Law Enforcement /CounterIntelligence Forensics Analyst (OPM 211)
Cyber Defense Forensics Analyst (OPM 212)

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

Reviews

It was very interesting to learn that certain 'forensic' tools could report data as being encrypted even though one could still get other data.

Gary Titus

Stroz Friedberg LLC

Really excellent course. Fantastic resource in the classroom material. Forensic challenge the last day was very fun.

This is the most comprehensive Mac class I've taken.

Daniel M.

US Federal Agency

Display times in

Africa/Abidjan

Africa/Accra

Africa/Addis Ababa

Africa/Algiers

Africa/Asmara

Africa/Asmera

Africa/Bamako

Africa/Bangui

Africa/Banjul

Africa/Bissau

Africa/Blantyre

Africa/Brazzaville

Africa/Bujumbura

Africa/Cairo

Africa/Casablanca

Africa/Ceuta

Africa/Conakry

Africa/Dakar

Africa/Dar es Salaam

Africa/Djibouti

Africa/Douala

Africa/El Aaiun

Africa/Freetown

Africa/Gaborone

Africa/Harare

Africa/Johannesburg

Africa/Juba

Africa/Kampala

Africa/Khartoum

Africa/Kigali

Africa/Kinshasa

Africa/Lagos

Africa/Libreville

Africa/Lome

Africa/Luanda

Africa/Lubumbashi

Africa/Lusaka

Africa/Malabo

Africa/Maputo

Africa/Maseru

Africa/Mbabane

Africa/Mogadishu

Africa/Monrovia

Africa/Nairobi

Africa/Ndjamena

Africa/Niamey

Africa/Nouakchott

Africa/Ouagadougou

Africa/Porto-Novo

Africa/Sao Tome

Africa/Timbuktu

Africa/Tripoli

Africa/Tunis

Africa/Windhoek

America/Adak

America/Anchorage

America/Anguilla

America/Antigua

America/Araguaina

America/Argentina/Buenos Aires

America/Argentina/Catamarca

America/Argentina/ComodRivadavia

America/Argentina/Cordoba

America/Argentina/Jujuy

America/Argentina/La Rioja

America/Argentina/Mendoza

America/Argentina/Rio Gallegos

America/Argentina/Salta

America/Argentina/San Juan

America/Argentina/San Luis

America/Argentina/Tucuman

America/Argentina/Ushuaia

America/Aruba

America/Asuncion

America/Atikokan

America/Atka

America/Bahia

America/Bahia Banderas

America/Barbados

America/Belem

America/Belize

America/Blanc-Sablon

America/Boa Vista

America/Bogota

America/Boise

America/Buenos Aires

America/Cambridge Bay

America/Campo Grande

America/Cancun

America/Caracas

America/Catamarca

America/Cayenne

America/Cayman

America/Chicago

America/Chihuahua

America/Ciudad Juarez

America/Coral Harbour

America/Cordoba

America/Costa Rica

America/Creston

America/Cuiaba

America/Curacao

America/Danmarkshavn

America/Dawson

America/Dawson Creek

America/Denver

America/Detroit

America/Dominica

America/Edmonton

America/Eirunepe

America/El Salvador

America/Ensenada

America/Fort Nelson

America/Fort Wayne

America/Fortaleza

America/Glace Bay

America/Godthab

America/Goose Bay

America/Grand Turk

America/Grenada

America/Guadeloupe

America/Guatemala

America/Guayaquil

America/Guyana

America/Halifax

America/Havana

America/Hermosillo

America/Indiana/Indianapolis

America/Indiana/Knox

America/Indiana/Marengo

America/Indiana/Petersburg

America/Indiana/Tell City

America/Indiana/Vevay

America/Indiana/Vincennes

America/Indiana/Winamac

America/Indianapolis

America/Inuvik

America/Iqaluit

America/Jamaica

America/Jujuy

America/Juneau

America/Kentucky/Louisville

America/Kentucky/Monticello

America/Knox IN

America/Kralendijk

America/La Paz

America/Lima

America/Los Angeles

America/Louisville

America/Lower Princes

America/Maceio

America/Managua

America/Manaus

America/Marigot

America/Martinique

America/Matamoros

America/Mazatlan

America/Mendoza

America/Menominee

America/Merida

America/Metlakatla

America/Mexico City

America/Miquelon

America/Moncton

America/Monterrey

America/Montevideo

America/Montreal

America/Montserrat

America/Nassau

America/New York

America/Nipigon

America/Nome

America/Noronha

America/North Dakota/Beulah

America/North Dakota/Center

America/North Dakota/New Salem

America/Nuuk

America/Ojinaga

America/Panama

America/Pangnirtung

America/Paramaribo

America/Phoenix

America/Port-au-Prince

America/Port of Spain

America/Porto Acre

America/Porto Velho

America/Puerto Rico

America/Punta Arenas

America/Rainy River

America/Rankin Inlet

America/Recife

America/Regina

America/Resolute

America/Rio Branco

America/Rosario

America/Santa Isabel

America/Santarem

America/Santiago

America/Santo Domingo

America/Sao Paulo

America/Scoresbysund

America/Shiprock

America/Sitka

America/St Barthelemy

America/St Johns

America/St Kitts

America/St Lucia

America/St Thomas

America/St Vincent

America/Swift Current

America/Tegucigalpa

America/Thule

America/Thunder Bay

America/Tijuana

America/Toronto

America/Tortola

America/Vancouver

America/Virgin

America/Whitehorse

America/Winnipeg

America/Yakutat

America/Yellowknife

Antarctica/Casey

Antarctica/Davis

Antarctica/DumontDUrville

Antarctica/Macquarie

Antarctica/Mawson

Antarctica/McMurdo

Antarctica/Palmer

Antarctica/Rothera

Antarctica/South Pole

Antarctica/Syowa

Antarctica/Troll

Antarctica/Vostok

Arctic/Longyearbyen

Asia/Aden

Asia/Almaty

Asia/Amman

Asia/Anadyr

Asia/Aqtau

Asia/Aqtobe

Asia/Ashgabat

Asia/Ashkhabad

Asia/Atyrau

Asia/Baghdad

Asia/Bahrain

Asia/Baku

Asia/Bangkok

Asia/Barnaul

Asia/Beirut

Asia/Bishkek

Asia/Brunei

Asia/Calcutta

Asia/Chita

Asia/Choibalsan

Asia/Chongqing

Asia/Chungking

Asia/Colombo

Asia/Dacca

Asia/Damascus

Asia/Dhaka

Asia/Dili

Asia/Dubai

Asia/Dushanbe

Asia/Famagusta

Asia/Gaza

Asia/Harbin

Asia/Hebron

Asia/Ho Chi Minh

Asia/Hong Kong

Asia/Hovd

Asia/Irkutsk

Asia/Istanbul

Asia/Jakarta

Asia/Jayapura

Asia/Jerusalem

Asia/Kabul

Asia/Kamchatka

Asia/Karachi

Asia/Kashgar

Asia/Kathmandu

Asia/Katmandu

Asia/Khandyga

Asia/Kolkata

Asia/Krasnoyarsk

Asia/Kuala Lumpur

Asia/Kuching

Asia/Kuwait

Asia/Macao

Asia/Macau

Asia/Magadan

Asia/Makassar

Asia/Manila

Asia/Muscat

Asia/Nicosia

Asia/Novokuznetsk

Asia/Novosibirsk

Asia/Omsk

Asia/Oral

Asia/Phnom Penh

Asia/Pontianak

Asia/Pyongyang

Asia/Qatar

Asia/Qostanay

Asia/Qyzylorda

Asia/Rangoon

Asia/Riyadh

Asia/Saigon

Asia/Sakhalin

Asia/Samarkand

Asia/Seoul

Asia/Shanghai

Asia/Singapore

Asia/Srednekolymsk

Asia/Taipei

Asia/Tashkent

Asia/Tbilisi

Asia/Tehran

Asia/Tel Aviv

Asia/Thimbu

Asia/Thimphu

Asia/Tokyo

Asia/Tomsk

Asia/Ujung Pandang

Asia/Ulaanbaatar

Asia/Ulan Bator

Asia/Urumqi

Asia/Ust-Nera

Asia/Vientiane

Asia/Vladivostok

Asia/Yakutsk

Asia/Yangon

Asia/Yekaterinburg

Asia/Yerevan

Atlantic/Azores

Atlantic/Bermuda

Atlantic/Canary

Atlantic/Cape Verde

Atlantic/Faeroe

Atlantic/Faroe

Atlantic/Jan Mayen

Atlantic/Madeira

Atlantic/Reykjavik

Atlantic/South Georgia

Atlantic/St Helena

Atlantic/Stanley

Australia/ACT

Australia/Adelaide

Australia/Brisbane

Australia/Broken Hill

Australia/Canberra

Australia/Currie

Australia/Darwin

Australia/Eucla

Australia/Hobart

Australia/LHI

Australia/Lindeman

Australia/Lord Howe

Australia/Melbourne

Australia/NSW

Australia/North

Australia/Perth

Australia/Queensland

Australia/South

Australia/Sydney

Australia/Tasmania

Australia/Victoria

Australia/West

Australia/Yancowinna

Brazil/Acre

Brazil/DeNoronha

Brazil/East

Brazil/West

CET

CST6CDT

Canada/Atlantic

Canada/Central

Canada/Eastern

Canada/Mountain

Canada/Newfoundland

Canada/Pacific

Canada/Saskatchewan

Canada/Yukon

Chile/Continental

Chile/EasterIsland

Cuba

EET

EST

EST5EDT

Egypt

Eire

Etc/GMT

Etc/GMT+0

Etc/GMT+1

Etc/GMT+10

Etc/GMT+11

Etc/GMT+12

Etc/GMT+2

Etc/GMT+3

Etc/GMT+4

Etc/GMT+5

Etc/GMT+6

Etc/GMT+7

Etc/GMT+8

Etc/GMT+9

Etc/GMT-0

Etc/GMT-1

Etc/GMT-10

Etc/GMT-11

Etc/GMT-12

Etc/GMT-13

Etc/GMT-14

Etc/GMT-2

Etc/GMT-3

Etc/GMT-4

Etc/GMT-5

Etc/GMT-6

Etc/GMT-7

Etc/GMT-8

Etc/GMT-9

Etc/GMT0

Etc/Greenwich

Etc/UCT

Etc/UTC

Etc/Universal

Etc/Zulu

Europe/Amsterdam

Europe/Andorra

Europe/Astrakhan

Europe/Athens

Europe/Belfast

Europe/Belgrade

Europe/Berlin

Europe/Bratislava

Europe/Brussels

Europe/Bucharest

Europe/Budapest

Europe/Busingen

Europe/Chisinau

Europe/Copenhagen

Europe/Dublin

Europe/Gibraltar

Europe/Guernsey

Europe/Helsinki

Europe/Isle of Man

Europe/Istanbul

Europe/Jersey

Europe/Kaliningrad

Europe/Kiev

Europe/Kirov

Europe/Kyiv

Europe/Lisbon

Europe/Ljubljana

Europe/London

Europe/Luxembourg

Europe/Madrid

Europe/Malta

Europe/Mariehamn

Europe/Minsk

Europe/Monaco

Europe/Moscow

Europe/Nicosia

Europe/Oslo

Europe/Paris

Europe/Podgorica

Europe/Prague

Europe/Riga

Europe/Rome

Europe/Samara

Europe/San Marino

Europe/Sarajevo

Europe/Saratov

Europe/Simferopol

Europe/Skopje

Europe/Sofia

Europe/Stockholm

Europe/Tallinn

Europe/Tirane

Europe/Tiraspol

Europe/Ulyanovsk

Europe/Uzhgorod

Europe/Vaduz

Europe/Vatican

Europe/Vienna

Europe/Vilnius

Europe/Volgograd

Europe/Warsaw

Europe/Zagreb

Europe/Zaporozhye

Europe/Zurich

GB-Eire

GMT

GMT+0

GMT-0

GMT0

Greenwich

HST

Hongkong

Iceland

Indian/Antananarivo

Indian/Chagos

Indian/Christmas

Indian/Cocos

Indian/Comoro

Indian/Kerguelen

Indian/Mahe

Indian/Maldives

Indian/Mauritius

Indian/Mayotte

Indian/Reunion

Iran

Israel

Jamaica

Japan

Kwajalein

Libya

MET

MST

MST7MDT

Mexico/BajaNorte

Mexico/BajaSur

Mexico/General

NZ-CHAT

Navajo

PRC

PST8PDT

Pacific/Apia

Pacific/Auckland

Pacific/Bougainville

Pacific/Chatham

Pacific/Chuuk

Pacific/Easter

Pacific/Efate

Pacific/Enderbury

Pacific/Fakaofo

Pacific/Fiji

Pacific/Funafuti

Pacific/Galapagos

Pacific/Gambier

Pacific/Guadalcanal

Pacific/Guam

Pacific/Honolulu

Pacific/Johnston

Pacific/Kanton

Pacific/Kiritimati

Pacific/Kosrae

Pacific/Kwajalein

Pacific/Majuro

Pacific/Marquesas

Pacific/Midway

Pacific/Nauru

Pacific/Niue

Pacific/Norfolk

Pacific/Noumea

Pacific/Pago Pago

Pacific/Palau

Pacific/Pitcairn

Pacific/Pohnpei

Pacific/Ponape

Pacific/Port Moresby

Pacific/Rarotonga

Pacific/Saipan

Pacific/Samoa

Pacific/Tahiti

Pacific/Tarawa

Pacific/Tongatapu

Pacific/Truk

Pacific/Wake

Pacific/Wallis

Pacific/Yap

Poland

Portugal

ROC

ROK

Singapore

Turkey

UCT

US/Alaska

US/Aleutian

US/Arizona

US/Central

US/East-Indiana

US/Eastern

US/Hawaii

US/Indiana-Starke

US/Michigan

US/Mountain

US/Pacific

US/Samoa

UTC

Universal

W-SU

WET

Zulu

Register for FOR518

Learn about Group Pricing

Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.

FOR518: Mac and iOS Forensic Analysis and Incident Response™

GIAC iOS and macOS Examiner (GIME)

Course Authors:

Sarah Edwards

What You Will Learn

What Is macOS and iOS Forensics Analysis?

Business Takeaways

Skills Learned

Hands-On macOS and iOS Forensics Training

Syllabus Summary

Additional Free Resources

What You Will Receive

Course topics

What Comes Next?

Syllabus (36 CPEs)

Mac and iOS Essentials

Overview

Exercises

Topics

Log Analysis, User Data, and System Configuration

Overview

Exercises

Topics

File Systems and Related Artifacts

Overview

Exercises

Topics

Application Data Analysis

Overview

Exercises

Topics

Advanced Analysis Topics

Overview

Exercises

Topics

Mac Forensics & Incident Response Challenge

Overview

Topics

GIAC iOS and macOS Examiner

Prerequisites

Laptop Requirements

MAC hardware is required for this course. The labs cannot be performed on anything other than native MAC hardware

MANDATORY FOR518 SYSTEM HARDWARE REQUIREMENTS

MANDATORY FOR518 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Author Statement

Ways to Learn

Who Should Attend FOR518?

Need to justify a training request to your manager?

Reviews

Filters:

Register for FOR518

Loading...