GIAC iOS and macOS Examiner Certification (GIME)

Digital Forensics Certification Overview

Validates Mac and iOS forensic analysis and incident response skills, from traditional investigations to intrusion analysis of compromised Apple devices.

Explore FOR518 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GIME Certification?

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's computer forensic analysis and incident response skills for Mac and iOS systems. GIME certification holders are qualified to carry out traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

By the numbers

2 hrs

Exam duration

Questions

67%

Min. passing score

What GIME Covers

GIAC publishes 13 exam objectives for GIME, and they group into five practical domains.

Apple Platform Foundations

Covers the Introduction to Apple Operating Systems, Introduction to Disk and File Systems, and Apple Systems Triage objectives.

Logs, Users, and Configuration

Covers the Log Analysis and Timeline Creation and User Data and System Configuration objectives.

File System and Document Artifacts

Covers the Apple File System Artifacts and Document and iCloud Analysis objectives.

Application Data Analysis

Covers the Application Fundamentals, Apple Application Analysis, and Productivity Application Analysis objectives.

Pattern of Life and Response

Covers the Pattern of Life, Encrypted Container and Memory Analysis, and Incident Response objectives.

Prepare With This Course

FOR518: Mac and iOS Forensic Analysis and Incident Response

Course Details

How FOR518 Prepares You for GIME

FOR518 is built around the exam objectives that make up the GIME certification:

Section 1, Mac and iOS Essentials builds skills tested under Introduction to Apple Operating Systems, Introduction to Disk and File Systems, and Apple Systems Triage.
Section 2, Log Analysis, User Data, and System Configuration aligns with Log Analysis and Timeline Creation and User Data and System Configuration.
Section 3, File Systems and Related Artifacts aligns with Apple File System Artifacts and Document and iCloud Analysis.
Section 4, Application Data Analysis builds skills tested under Application Fundamentals, Apple Application Analysis, and Productivity Application Analysis.
Section 5, Advanced Analysis Topics aligns with Pattern of Life, Encrypted Container and Memory Analysis, and Incident Response.
Section 6, Mac Forensics & Incident Response Challenge applies the skills from the earlier sections in a CTF-style scenario.

Across the course, 23 hands-on labs and a closing CTF-style challenge give you the chance to apply each skill to the course dataset before you sit the exam.

Read the full GIME certification overview

FOR518 Course Author

Sarah Edwards

Head Of DFIR at iVerify

Sarah Edwards is a pioneering force in Apple forensics, having revolutionized the field through the creation of APOLLO—an open-source tool that deciphers macOS and iOS pattern-of-life data.

Who Should Pursue GIME

Experienced Digital Forensic Analysts

Law Enforcement Officers, Federal Agents, and Detectives

Media Exploitation Analysts

Incident Response Team Members

Information Security Professionals Seeking macOS and iOS System Internals Expertise

SANS DFIR Alumni Looking to Round Out Their Forensic Skills

Frequently Asked Questions

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's computer forensic analysis and incident response skills for Mac and iOS systems. Holders are qualified to carry out traditional investigations and intrusion analysis scenarios for compromised Apple devices.

GIME is one proctored exam with 75 questions, a 2-hour time limit, and a minimum passing score of 67%. GIAC periodically reviews exam specifications, so confirm the details for your attempt in your GIAC account.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GIME fits experienced digital forensic analysts, law enforcement officers, federal agents and detectives, media exploitation analysts, incident response team members, and information security professionals who want expertise in macOS and iOS system internals. SANS DFIR alumni looking to round out their forensic skills are also a fit.

FOR518: Mac and iOS Forensic Analysis and Incident Response maps to the GIME exam objectives and includes 23 hands-on labs plus a closing CTF-style challenge, run on native Apple Silicon Mac hardware. It provides great training if you're thinking of pursuing GIME, and completing it is not required for GIAC certification. You can also buy a GIME practice test from GIAC's listing.

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GIME certification?

Add the GIME exam attempt when you register for FOR518.

Already trained? Register for the exam directly through GIAC.

SEC536: Adversarial AI - Penetration Testing AI Systems