FOR518: Mac and iOS Forensic Analysis and Incident Response

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Apple Silicon (M*) Mac hardware is required for this course. The labs cannot be performed on anything other than native Mac hardware

Mandatory System Hardware Requirements

• Apple Silicon (M*) System
• 16GB of RAM or more is required.
• 200GB of free internal storage space or more is required. (Downloaded ISO files (approx. 130GB) can be stored on external media until Setup - Lab 0 is completed.)
• At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.

Additional requirements for this course:

• Apple MacOS 14 or newer is required.

Mandatory Host Configuration And Software Requirements

• Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
• You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact customer service.

FOR518 training is recommended for a diverse range of individuals, including:

• Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of file system forensics and advanced Mac analysis.
• Law Enforcement Officers, Federal Agents, and Detectives who want to master advanced computer forensics and expand their investigative skill set.
• Media Exploitation Analysts who need to know where to find the critical data they need from a Mac system.
• Incident Response Team Members who are responding to complex security incidents/intrusions from sophisticated adversaries and need to know what to do when examining a compromised system.
• Information Security Professionals who want to become knowledgeable about MacOS and iOS system internals.
• SANS FOR500, FOR508, SEC575, and FOR585 Alumni looking to round out their forensic skills.

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

• Mac and iOS File Systems, System Triage, and Application Data
• Mac and iOS Incident Response, Malware, and Intrusion Analysis
• Mac and iOS User Data and Timeline Analysis

More Certification Details

• Course ISOs loaded with dataset and tools
• MP3 audio files of the complete course lecture
• Digital and physical copies of course books and workbook
• Relevant SANS Posters

Working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

• Code Academy
• Learn Enough

The FOR518 course is a part of the “Digital Forensics, Malware Analysis, & Threat Intelligence” Learning Path, which aims to equip cybersecurity professionals with specialized investigative skills.

Depending on your current or desired future role, one of these courses is a great next step in your cybersecurity journey:

• FOR509 Enterprise Cloud Forensics & Incident Response
• FOR528 Ransomware and Cyber Extortion
• FOR577 Linux Incident Response & Analysis
• FOR578 Cyber Threat Intelligence
• FOR585 Smartphone Forensic Analysis In-Depth
• FOR589 Cybercrime Intelligence
• FOR610 Reverse-Engineering Malware: Malware Analysis Tools and Techniques
• FOR710 Reverse-Engineering Malware: Advanced Code Analysis

Mac and iOS forensic analysis involves extracting, examining, and interpreting data from Apple devices to uncover evidence for investigations. This specialized field is critical due to the widespread use of Apple products, which store a wealth of personal and professional data, including communications, browsing history, location information, and app usage.

Why it’s important:

• Apple devices use proprietary technologies (e.g., APFS, Keychain, iCloud) that require tailored forensic techniques.
• Analysts can retrieve deleted files, uncover encrypted data, and analyze metadata for valuable insights.
• Mac and iOS forensics play a key role in solving crimes, corporate disputes, and cybersecurity incidents.
• Forensics helps identify compromises and mitigate threats on Apple devices.
• With Apple’s growing presence, mastering these skills is essential for modern forensic investigators.

As Apple devices dominate the tech landscape, organizations increasingly require specialists who can investigate and respond to incidents involving macOS and iOS systems.

Here are some key benefits of taking FOR518: Mac and iOS Forensic Analysis and Incident Response:

• Gain in-depth knowledge of Apple ecosystems, including file systems, metadata, and app artifacts, which are critical in modern investigations.
• Equip yourself with skills to tackle complex cases, making you a valuable asset in roles such as forensic analyst, incident responder, or cybersecurity consultant.
• Open doors to industries like law enforcement, corporate security, and government, where Apple device expertise is in high demand.
• Learn practical techniques, from analyzing encrypted data to conducting malware investigations, boosting your professional capabilities.
• This course provides the tools and knowledge needed to stay ahead in the field of digital forensics and incident response, ensuring long-term career growth.