FOR518: Mac & IOS Forensic Analysis & Incident Response Training

What You Will Learn

Digital forensic and incident response investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iDevice? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms. Dealing with these devices as an investigator is no longer a niche skill - every analyst must have the core skills necessary to investigate the Apple devices they encounter.

This consistently updated FOR518 course provides the techniques and skills necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. In addition to traditional investigations, the course presents intrusion and incident response scenarios to help analysts learn ways to identify and hunt down attackers that have compromised Apple devices.

Forensicate Differently!

FOR518: Mac and iOS Forensic Analysis and Incident Response will teach you:

Mac and iOS Fundamentals: How to analyze and parse the Apple File System (APFS) by hand and recognize the specific domains of the logical file system and Apple specific file types.
User Activity: How to understand and profile users through their data files and preference configurations.
Advanced Intrusion Analysis and Correlation: How to determine how a system has been used or compromised by using the system and user data files in correlation with system log files.
Apple Technologies: How to understand and analyze many Mac and iOS-specific technologies, including Spotlight, iCloud, Document Versions, FileVault, Continuity, Time Machine and FaceTime.

FOR518: Mac and iOS Forensic Analysis and Incident Response aims to train a well-rounded investigator by diving deep into forensic and intrusion analysis of Mac and iOS. The course focuses on topics such as the APFS file system, Mac-specific data files, tracking of user activity, system configuration, analysis and correlation of Mac logs, Mac applications, and Mac-exclusive technologies. A computer forensic analyst who completes this course will have the skills needed to take on a Mac or iOS forensics case.

FOR518 Will Prepare You To

Parse the APFS file system by hand, using only a reference sheet and a hex editor
Understand the APFS file system and its significance
Determine the importance of each file system domain
Conduct temporal analysis of a system by correlating data files and log analysis
Profile how individuals used the system, including how often they used the system, what applications they frequented, and their personal system preferences
Identify remote or local data backups, disk images, or other attached devices
Find encrypted containers and FileVault volumes, understand keychain data, and crack Mac passwords
Analyze and understand Mac metadata and their importance in the Spotlight database, Time Machine, and Extended Attributes
Develop a thorough knowledge of the Safari Web Browser and Apple Mail applications
Identify communication with other users and systems though iChat, Messages, FaceTime, Remote Login, Screen Sharing, and AirDrop
Conduct an intrusion analysis of a Mac for signs of compromise or malware infection
Acquire and analyze memory from Mac systems
Acquire iOS and analyze devices in-depth

Course Topics

In-Depth APFS File System Examination
File System Timeline Analysis
Advanced Computer Forensics Methodology
Mac-Specific Acquisition and Incident Response Collection
Mac Memory Acquisition and Analysis
File System Data Analysis
Metadata Analysis
Recovery of Key Mac and iOS Files
Volume and Disk Image Analysis
Analysis of Mac Technologies, including Time Machine, Spotlight, and FileVault
Advanced Log Analysis and Correlation
iDevice Analysis and iOS Artifacts

What You Will Receive

90-Day trial for Cellebrite Inspector Forensic Analysis Software
Course ISOs loaded with case examples, tools, tool reference sheets, and documentation
MP3 audio files of the complete course lecture

Syllabus (36 CPEs)

Download PDF

FOR518.1: Mac and iOS Essentials
Overview
This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully and easily collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.
Exercises
- Course Lab Setup
- Inspector Case Setup and Image Mounting
- Exploring iOS Acquisitions
- Disks and Partitions
Topics
- Apple Essentials
- Mac Essentials and Acquisition
- iOS Essentials and Acquisition
- Disks and Partitions
FOR518.2: File Systems & System Triage
Overview
Starting out, students will review Mac and iOS triage data. This data is often required to start an analysis of a device. Students will then build on that information to look at a variety of great artifacts that implement the file system and that are different from other operating systems students have seen in the past. In an additional bonus section students will learn the building blocks of Mac and iOS forensics with a thorough deep-dive understanding of the Apple File system (APFS). Utilizing a hex editor, students will learn the basic structures of the primary file system implemented on MacOS and iOS systems.
Exercises
- Mac and iOS Triage
- File System Fun!
- Parsing APFS
Topics
- Mac and iOS Triage
- Extended Attributes
- File System Events Store Database
- Spotlight
- Portable Artifacts
- File Systems
  Overview of HFS+ & APFS
  Data Structures
  Manual Parsing
  APFS Clones
  APFS Snapshots
  APFS Benefits and Caveats
FOR518.3: User Data, System Configuration, and Log Analysis
Overview
Mac and iOS devices contain many system settings that can show how a device was used (or abused). A user of the device may change a specific configuration that can provide useful forensic insight. Often these configuration actions can be also found in the logs and provide historical context to create a detailed story of how the device was used.
This section focuses on system and data configurations alongside log analysis. These devices have many different types of logs each with their own method for analysis and content. The log entries can be correlated with user and system data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently.
Exercises
- Parsing System Logs
- Log Analysis
- User Data and System Configuration, Part I and Part II
Topics
- Parsing System Logs
  Log Basics
  Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
  Log Configuration
  Analysis Methods and Parsing Tools
- Log Analysis
  Tools & Methods
  Volume Analysis
  System State
  Software Installations
  Application Bundles & Extensions
  AirDrop
- User Data and System Configuration
FOR518.4: Application Data Analysis
Overview
In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.
This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.
Exercises
- iOS Snapshots, App Permissions, and MRUs
- Safari and Mail
- Applications Part I
- Applications Part II
Topics
- Application Fundamentals
- SQL Lite
  Building Queries
  Database Analysis
- Safari Browser
- Apple Mail
- Communication
- Many Other Applications
FOR518.5: Advanced Analysis Topics
Overview
Apple systems implement some technologies that are available only to those with Mac and iOS devices. In this section, students will learn about a variety of topics that can be used in a variety of investigations. Topics such as pattern of life will detail very specific user and device activities which can determine which app was being used at precise time, how many steps did they walk, was the device unlocked, or where the device was.
Other technologies include Document Versions which provide historical snapshots of documents and iCloud data syncing. Other advanced topics include cracking into data hidden in encrypted containers, live response, indicators of compromise, security technologies, malware analysis, and Mac memory analysis.
Exercises
- Pattern of Life
- Document Versions
- Malware and Live Response
- Memory Analysis, Password Cracking, and Encrypted Containers
Topics
- Pattern of Life
- Document Versions
- iCloud
- Apple Malware
- Live Response
- Memory Acquisitions and Analysis
- Password Cracking and Encrypted Containers
FOR518.6: Mac Forensics & Incident Response Challenge
Overview
In this final course section, students will put their new Mac forensic skills to the test by running through a real-life scenario with team members.
Topics:
- In-Depth File System Examination
- File System Timeline Analysis
- Advanced Computer Forensics Methodology
- Mac Memory Analysis
- File System Data Analysis
- Metadata Analysis
- Recovering Key Mac Files
- Volume and Disk Image Analysis
- Analysis of Apple-specific Technologies
- Advanced Log Analysis and Correlation
- iDevice Analysis and iOS Artifacts

GIAC iOS and macOS Examiner

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

Mac and iOS File Systems, System Triage, User and Application Data Analysis
Mac and iOS Incident Response, Malware, and Intrusion Analysis
Mac and iOS Memory Forensics and Timeline Analysis

More Certification Details

Prerequisites

Working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

https://www.codecademy.com/learn/learn-the-command-line

https://www.learnenough.com/command-line-tutorial

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MAC HARDWARE IS REQUIRED FOR THIS COURSE. THE LABS CANNOT BE PERFORMED ON ANYTHING OTHER THAN NATIVE MAC HARDWARE.

MANDATORY FOR518 SYSTEM HARDWARE REQUIREMENTS

8GB of RAM or more is required.
250GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Additional requirements for this course:

Apple MacOS 10.13 or newer is required.

MANDATORY FOR518 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org

Author Statement

"This course is designed to enable an analyst comfortable in Windows-based forensics to perform just as well on a Mac. The Mac and iOS market share is ever-increasing, and the Apple is now a popular platform for many companies and government entities. I believe a well-rounded forensic analyst is an extremely well-prepared and employable individual in a Windows forensics world. Windows analysis is the base education in the competitive field of digital forensics, but any additional skills you can acquire can set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis.

Mac and iOS forensics is truly a passion of mine that I genuinely want to share with the forensics community. While you may not work on a Mac or iOS investigation every day, the tools and techniques you learn in this course will help you with other investigations including Windows, Linux, and mobile." - Sarah Edwards

"FOR518 is a great course for forensics people and organizations that use Mac within their environments, and the labs were really engaging. Sarah is an expert in this field and a great instructor, and she's really responsive to our comments and questions." - Ali Memarzia, Google

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

In Person (6 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

Who Should Attend FOR518?

Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of file system forensics and advanced Mac analysis.
Law Enforcement Officers, Federal Agents, and Detectives who want to master advanced computer forensics and expand their investigative skill set.
Media Exploitation Analysts who need to know where to find the critical data they need from a Mac system.
Incident Response Team Members who are responding to complex security incidents/intrusions from sophisticated adversaries and need to know what to do when examining a compromised system.
Information Security Professionals who want to become knowledgeable about MacOS and iOS system internals.
SANS FOR500, FOR508, FOR526, FOR610, and FOR585 Alumni looking to round out their forensic skills.

NICE Framework Roles:

Cyber Defense Incident Responder (OPM 531)
Cyber Crime Investigator (OPM 221)
Law Enforcement /CounterIntelligence Forensics Analyst (OPM 211)
Cyber Defense Forensics Analyst (OPM 212)

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

FOR518: Mac and iOS Forensic Analysis and Incident Response

GIAC iOS and macOS Examiner (GIME)

Course Authors:

Sarah Edwards

What You Will Learn

Syllabus (36 CPEs)

FOR518.1: Mac and iOS Essentials

Overview

Exercises

Topics

FOR518.2: File Systems & System Triage

Overview

Exercises

Topics

FOR518.3: User Data, System Configuration, and Log Analysis

Overview

Exercises

Topics

FOR518.4: Application Data Analysis

Overview

Exercises

Topics

FOR518.5: Advanced Analysis Topics

Overview

Exercises

Topics

FOR518.6: Mac Forensics & Incident Response Challenge

Overview

GIAC iOS and macOS Examiner

Prerequisites

Laptop Requirements

Author Statement

Ways to Learn

Who Should Attend FOR518?

Need to justify a training request to your manager?

Reviews

Filters:

Register for FOR518

Loading...