homepage
Open menu

FOR518: Mac and iOS Forensic Analysis and Incident Response

GIAC iOS and macOS Examiner (GIME)
GIAC iOS and macOS Examiner (GIME)
Register Now Course Demo
  • In Person (6 days)
  • Online
36 CPEs

FOR518 is the first non-vendor-based Mac and iOS incident response and forensics course that focuses students on the raw data, in-depth detailed analysis, and how to get the most out of their Mac and iOS cases. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device.

Course Authors:
Sarah Edwards
Sarah Edwards
Senior Instructor
What You Will LearnSyllabusCertificationPrerequisitesLaptop RequirementsAuthor StatementReviewsTraining & Pricing

What You Will Learn

Digital forensic and incident response investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iDevice? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms. Dealing with these devices as an investigator is no longer a niche skill - every analyst must have the core skills necessary to investigate the Apple devices they encounter.

The constantly updated FOR518: Mac and iOS Forensic Analysis and Incident Response course provides the techniques and skills necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. In addition to traditional investigations, the course presents intrusion and incident response scenarios to help analysts learn ways to identify and hunt down attackers that have compromised Apple devices.

Forensicate Differently!

FOR518: Mac and iOS Forensic Analysis and Incident Response will teach you:

  1. Mac and iOS Fundamentals: How to analyze and parse the Apple File System (APFS+) by hand and recognize the specific domains of the logical file system and Mac-specific file types.
  2. User & Device Activity: How to understand, profile, and conduct advanced pattern-of-life on users and they devices through their data files and preference configurations.
  3. Advanced Intrusion Analysis and Correlation: How to determine how a system has been used or compromised by using the system and user data files in correlation with system log files.
  4. Apple Technologies: How to understand and analyze many Mac and iOS-specific technologies, including Time Machine, Spotlight, iCloud, Document Versions, FileVault, Continuity, and FaceTime.

FOR518: Mac and iOS Forensic Analysis and Incident Response aims to train a well-rounded investigator by diving deep into forensic and intrusion analysis of Mac and iOS. The course focuses on topics such as the APFS file system, Mac-specific data files, tracking of user activity, system configuration, analysis and correlation of Mac logs, Mac applications, and Mac-exclusive technologies. A computer forensic analyst who completes this course will have the skills needed to take on a Mac or iOS forensics case.

FOR518 Will Prepare You To

  • Parse the HFS+ file system by hand, using only a cheat sheet and a hex editor
  • Understand the APFS file system and its significance
  • Determine the importance of each file system domain
  • Conduct temporal analysis of a system by correlating data files and log analysis
  • Profile how individuals used the system, including how often they used the system, what applications they frequented, and their personal system preferences
  • Identify remote or local data backups, disk images, or other attached devices
  • Find encrypted containers and FileVault volumes, understand keychain data, and crack Mac passwords
  • Analyze and understand Mac metadata and their importance in the Spotlight database, Time Machine, and Extended Attributes
  • Develop a thorough knowledge of the Safari Web Browser and Apple Mail applications
  • Identify communication with other users and systems though iChat, Messages, FaceTime, Remote Login, Screen Sharing, and AirDrop
  • Conduct an intrusion analysis of a Mac for signs of compromise or malware infection
  • Acquire and analyze memory from Mac systems
  • Acquire iOS and analyze devices in-depth

Course Topics

  • In-Depth HFS+ File System Examination and an Introduction to APFS
  • File System Timeline Analysis
  • Advanced Computer Forensics Methodology
  • Mac-Specific Acquisition and Incident Response Collection
  • Mac Memory Acquisition and Analysis
  • File System Data Analysis
  • Metadata Analysis
  • Recovery of Key Mac Files
  • Volume and Disk Image Analysis
  • Analysis of Mac Technologies, including Time Machine, Spotlight, and FileVault
  • Advanced Log Analysis and Correlation
  • iDevice Analysis and iOS Artifacts

What You Will Receive

  • 90-Day trial for BlackBag Technologies BlackLight Forensic Analysis Software
  • Course Downloadable package loaded with case examples, tools, and documentation
  • MP3 audio files of the complete course lecture

SANS Video

Syllabus (36 CPEs)

Download PDF
  • Overview

    This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully and easily collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.

    Exercises
    • Lab Setup
    • BlackLight and Image Mounting
    • Exploring iOS Acquisitions
    • Disks and Partitions

    Topics
    • Apple Essentials
      • Mac and iOS Systems
      • Mac Analysis in a Windows World
      • Apple Fundamentals
    • Mac Essentials and Acquisition
      • Mac File System Domains
      • Mac Directory Structures
      • Containers and Sandboxes
      • Acquisition Pitfalls and Considerations
      • Hard Drive, Network, and Memory Acquisition Tools
      • Image Mounting Using Open-Source Utilities
    • iOS Essentials and Acquisition
      • Differences between iOS and macOS
      • Security and Encryption
      • Jailbreaks
      • Acquisition Types and Differences
      • Local and iCloud Backups
      • Tools for Acquisition and Analysis
      • Passcode Bypass and Cracking
    • Disks and Partitions
      • Disk Layout
      • Partition Schemes
      • GPT
      • FileVault
      • Disk Images
      • CoreStorage
      • APFS Containers
      • Bootcamp
      • Fusion Drives

  • Overview

    The building blocks of Mac and iOS forensics start with a thorough understanding of the HFS+. Utilizing a hex editor, students will learn the basic principles of the primary file system implemented on MacOS systems. Students will then use that information to look at a variety of great artifacts that use the file system and that are different from other operating systems students have seen in the past. Rounding out the day, students will review Mac and iOS triage data.

    Exercises
    • HFS+
    • File System Fun!
    • Mac and iOS Triage

    Topics
    • File Systems
      • Overview of HFS+ & APFS
      • Data Structures
      • Manual Parsing
      • APFS Clones
      • APFS Snapshots
      • APFS Benefits and Caveats
      • Tool Output and Caveats
    • Extended Attributes
      • Contents
      • Analysis
      • Tool Support
      • Interesting Attributes
    • File System Events Store Database
      • Usage
      • Parsing with Tools
      • Practical Analysis
    • Spotlight
      • Analysis Methods and Tools
      • Practical Queries
      • Portable Artifacts
      • Artifacts Left Behind by Macs
      • Differences from Various File Systems
    • Mac and iOS Triage
      • OS Version
      • Device Identifying Data
      • System Installation
      • Network Settings
      • Time Zone and Location Services
      • User Accounts
      • Managed Devices
      • Mail and Internet Account Settings
    • Most Recently Used (MRUs)
      • Recent iOS Apps
      • Recent Folders
      • Recent Applications
      • Recent Documents
      • Recent Servers
      • Recent Files
      • Parsing Methods and Tools
      • Alias and Bookmark BLOBs
      • NSKeyed Archiver Plist File Manual Parsing

  • Overview

    This section contains a wide array of information that can be used to profile and understand how individuals use their computers. The logical Mac file system is made up of four domains: User, Local, System, and Network. The User Domain contains most of the user-related items of forensic interest. This domain consists of user preferences and configurations.

    The Local and System Domains contain system-specific information such as application installation, system settings and preferences, and system logs. This section details basic system information, GUI preferences, and system application data. A basic analysis of system logs can provide a good understanding of how a system was used or abused. The Network domain is more ethereal and we can find this in many places throughout the course as well as in the logs.

    Timeline analysis tells the story of how the system was used. Each entry in a log file has a specific meaning and may be able to tell how the user interacted with the computer. The log entries can be correlated with other data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently. Analysis tools and techniques will be used to correlate the data and help the student put the story back together in a coherent and meaningful way.

    Exercises
    • User Data and System Configuration
    • Log Parsing and Analysis
    • Timeline Analysis and Data Correlation

    Topics
    • User Data and System Configuration
      • Bash History
      • Keychains
      • Printing
      • Firewall Settings
      • Sharing Settings
      • Bluetooth
      • Autoruns
      • Application Bundles
      • Software Updates
      • GUI Settings
    • Log Parsing and Analysis
      • Log Basics
      • Log Formats
      • Log Recovery
      • Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
      • Log Configuration
      • Analysis Methods and Parsing Tools
    • Timeline Analysis and Data Correlation
      • Temporal Context and Timestamps
      • Volume Analysis
      • Temporal Changes
      • System Information and State
      • Network Analysis
      • User Access
      • Privilege Escalation
      • Account Creation/Deletion
      • Software Installation
      • Backup Activity
      • Locational Data

  • Overview

    In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.

    This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.

    Exercises
    • Safari and Mail
    • Applications - Part I
    • Applications - Part II

    Topics
    • Application Permissions
      • Privacy Settings
      • Location Services
    • Native Application Fundamentals
      • Locations
      • Snapshots
    • Safari Browser
      • History
      • Cache
      • Syncing
      • Private Mode
      • Data Retention
    • Apple Mail
      • Locations and Data Access
      • Mail Accounts and Configuration
      • Attachments
      • Metadata
    • Communication
      • iChat/Messages
      • FaceTime
      • SMS
      • iMessage
      • Call History
      • Voicemail
    • Calendar and Reminders
      • Files
      • Database Analysis
    • Contacts
      • Files
      • Database Analysis
    • Notes
      • Files
      • Database Analysis
      • Version Differences
      • Media Analysis
    • Apple Pay, Wallet, Passes
      • Files
      • Database Analysis
    • Photos
      • Files
      • Database Analysis
      • iCloud Syncing
    • Maps
      • Files
      • Database Analysis
      • Caveats
    • Location Data
      • Routine, WiFi, Cellular Locations
      • Files
      • Database Analysis
      • Tools and Parsing
    • Apple Watch
      • Files
      • Capabilities
      • Synced Data
    • Third-Party Apps
      • Locations
      • Analysis Caveats
      • Data Structure
      • Analysis Tools
  • Overview

    Mac systems implement some technologies that are available only to those with Mac and iOS devices. These include data backup with Time Machine, Document Versions, and iCloud, as well as disk encryption with FileVault. Other advanced topics include data hidden in encrypted containers, live response, Mac intrusion and malware analysis, and Mac memory analysis.

    Exercises
    • Time Machine and Document Versions
    • Malware and Live Response
    • Memory Analysis, Password Cracking, and Encrypted Containers

    Topics
    • Time Machine
      • Backup Settings
      • Backup Volumes
      • Snapshot Analysis
      • Local Snapshots
      • Encrypted Backups
      • Mounting and Analysis
    • Document Versions
      • Versions Metadata
      • Versions Database
      • Generations
      • Chunk Storage
    • iCloud
      • Synced Accounts
      • Mobile Documents
      • Synced Preferences
    • Malware and Intrusion Analysis
      • Intrusion Analysis
      • Java Cache and IDX Files
      • File Quarantine
      • XProtect
      • Gatekeeper
    • Live Response
      • Live Triage Techniques
      • Volatile Data Collection
    • Memory Acquisitions and Analysis
      • Acquisition Tools
      • Analysis Tools
    • Password Cracking and Encrypted Containers
      • Password Shadow Files
      • Cracking Software
      • Keychains
      • FileVault
      • Encrypted Volumes and Disk Images

  • Overview

    In this final course section, students will put their new Mac forensic skills to the test by running through a real-life scenario with team members.

    Topics:

    • In-Depth File System Examination
    • File System Timeline Analysis
    • Advanced Computer Forensics Methodology
    • Mac Memory Analysis
    • File System Data Analysis
    • Metadata Analysis
    • Recovering Key Mac Files
    • Volume and Disk Image Analysis
    • Analysis of Mac Technologies including Time Machine, Spotlight, and FileVault
    • Advanced Log Analysis and Correlation
    • iDevice Analysis and iOS Artifacts

GIAC iOS and macOS Examiner

The GIME certification validates a practitioner’s knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

  • Mac and iOS File Systems, System Triage, User and Application Data Analysis
  • Mac and iOS Incident Response, Malware, and Intrusion Analysis
  • Mac and iOS Memory Forensics and Timeline Analysis
More Certification Details

Prerequisites

Working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

https://www.learnenough.com/command-line-tutorial

Laptop Requirements

Important! Bring your own system configured according to these instructions!

**************************IMPORTANT NOTE: MAC HARDWARE IS REQUIRED*************************************

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

It is critical that you follow the pre-class Mac System Setup Guide for your Mac. The guide is available at http://sans.org/security-resources/FOR518-laptop-setup-guide-v2.pdf. It is crucial that you read and follow the instructions in this pre-class Mac system setup guide before attending class the first day. The guide is a detailed step-by-step walk-through of a variety of downloads and configuration steps needed to prep your system for an in-depth and exciting week of Mac and iOS forensics. Please follow all of the steps correctly, otherwise your enjoyment of the class could be impacted. We recommend setting up your system at home, as hotel Internet might not be adequate to finalize the setup before class. Please do not wait until the night before class to go through the setup guide.

A properly configured Mac system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

MANDATORY FOR518 SYSTEM HARDWARE AND SOFTWARE REQUIREMENTS:

  • Apple Mac laptop with the following minimum configuration:
  • MacOS 10.13 (or newer)
  • CPU: Intel Core i5/i7 Series (a high-end Intel 2.8Ghz+ Core 2 Duo may also suffice)
  • Wireless 802.11 capability
  • 8GB RAM or more is recommended
  • At least 250 gigabytes of free space on your system hard drive or on an external hard drive.
  • USB 2.0 port(s) or higher (Please bring your USB-C to USB-A adapters for the new Macs!)
  • Students should have the capability to have Local Administrator Access within their host operating system. Some monitoring and AV software may interfere with some exercises, so please be able to turn these off when needed.
  • IMPORTANT NOTE: MAC HARDWARE IS REQUIRED

Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

"This course is designed to enable an analyst comfortable in Windows-based forensics to perform just as well on a Mac. The Mac and iOS market share is ever-increasing, and the Apple is now a popular platform for many companies and government entities. I believe a well-rounded forensic analyst is an extremely well-prepared and employable individual in a Windows forensics world. Windows analysis is the base education in the competitive field of digital forensics, but any additional skills you can acquire can set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis.

Mac and iOS forensics is truly a passion of mine that I genuinely want to share with the forensics community. While you may not work on a Mac or iOS investigation every day, the tools and techniques you learn in this course will help you with other investigations including Windows, Linux, and mobile." - Sarah Edwards

"FOR518 is a great course for forensics people and organizations that use Mac within their environments, and the labs were really engaging. Sarah is an expert in this field and a great instructor, and she's really responsive to our comments and questions." - Ali Memarzia, Google

Ways to Learn

  • OnDemand

Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

  • Live Online

Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

  • In Person (6 days)

Training events and topical summits feature presentations and courses in classrooms around the world.

Who Should Attend FOR518?

  • Experienced Digital Forensic Analysts who want to consolidate and expand their understanding of file system forensics and advanced Mac analysis.
  • Law Enforcement Officers, Federal Agents, and Detectives who want to master advanced computer forensics and expand their investigative skill set.
  • Media Exploitation Analysts who need to know where to find the critical data they need from a Mac system.
  • Incident Response Team Members who are responding to complex security incidents/intrusions from sophisticated adversaries and need to know what to do when examining a compromised system.
  • Information Security Professionals who want to become knowledgeable about MacOS and iOS system internals.
  • SANS FOR500, FOR508, FOR526, FOR610, and FOR585 Alumni looking to round out their forensic skills.

"Within the first two days or training, I had enough knowledge to go back to work and solve two outstanding issues." - Beau G, Information Systems Solutions

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

Reviews

It was very interesting to learn that certain 'forensic' tools could report data as being encrypted even though one could still get other data.
Gary Titus
Stroz Friedberg LLC
Really excellent course. Fantastic resource in the classroom material. Forensic challenge the last day was very fun.
This is the most comprehensive Mac class I've taken.
Daniel M.
US Federal Agency
    Africa/Abidjan
    Africa/Accra
    Africa/Addis Ababa
    Africa/Algiers
    Africa/Asmara
    Africa/Asmera
    Africa/Bamako
    Africa/Bangui
    Africa/Banjul
    Africa/Bissau
    Africa/Blantyre
    Africa/Brazzaville
    Africa/Bujumbura
    Africa/Cairo
    Africa/Casablanca
    Africa/Ceuta
    Africa/Conakry
    Africa/Dakar
    Africa/Dar es Salaam
    Africa/Djibouti
    Africa/Douala
    Africa/El Aaiun
    Africa/Freetown
    Africa/Gaborone
    Africa/Harare
    Africa/Johannesburg
    Africa/Juba
    Africa/Kampala
    Africa/Khartoum
    Africa/Kigali
    Africa/Kinshasa
    Africa/Lagos
    Africa/Libreville
    Africa/Lome
    Africa/Luanda
    Africa/Lubumbashi
    Africa/Lusaka
    Africa/Malabo
    Africa/Maputo
    Africa/Maseru
    Africa/Mbabane
    Africa/Mogadishu
    Africa/Monrovia
    Africa/Nairobi
    Africa/Ndjamena
    Africa/Niamey
    Africa/Nouakchott
    Africa/Ouagadougou
    Africa/Porto-Novo
    Africa/Sao Tome
    Africa/Timbuktu
    Africa/Tripoli
    Africa/Tunis
    Africa/Windhoek
    America/Adak
    America/Anchorage
    America/Anguilla
    America/Antigua
    America/Araguaina
    America/Argentina/Buenos Aires
    America/Argentina/Catamarca
    America/Argentina/ComodRivadavia
    America/Argentina/Cordoba
    America/Argentina/Jujuy
    America/Argentina/La Rioja
    America/Argentina/Mendoza
    America/Argentina/Rio Gallegos
    America/Argentina/Salta
    America/Argentina/San Juan
    America/Argentina/San Luis
    America/Argentina/Tucuman
    America/Argentina/Ushuaia
    America/Aruba
    America/Asuncion
    America/Atikokan
    America/Atka
    America/Bahia
    America/Bahia Banderas
    America/Barbados
    America/Belem
    America/Belize
    America/Blanc-Sablon
    America/Boa Vista
    America/Bogota
    America/Boise
    America/Buenos Aires
    America/Cambridge Bay
    America/Campo Grande
    America/Cancun
    America/Caracas
    America/Catamarca
    America/Cayenne
    America/Cayman
    America/Chicago
    America/Chihuahua
    America/Coral Harbour
    America/Cordoba
    America/Costa Rica
    America/Creston
    America/Cuiaba
    America/Curacao
    America/Danmarkshavn
    America/Dawson
    America/Dawson Creek
    America/Denver
    America/Detroit
    America/Dominica
    America/Edmonton
    America/Eirunepe
    America/El Salvador
    America/Ensenada
    America/Fort Nelson
    America/Fort Wayne
    America/Fortaleza
    America/Glace Bay
    America/Godthab
    America/Goose Bay
    America/Grand Turk
    America/Grenada
    America/Guadeloupe
    America/Guatemala
    America/Guayaquil
    America/Guyana
    America/Halifax
    America/Havana
    America/Hermosillo
    America/Indiana/Indianapolis
    America/Indiana/Knox
    America/Indiana/Marengo
    America/Indiana/Petersburg
    America/Indiana/Tell City
    America/Indiana/Vevay
    America/Indiana/Vincennes
    America/Indiana/Winamac
    America/Indianapolis
    America/Inuvik
    America/Iqaluit
    America/Jamaica
    America/Jujuy
    America/Juneau
    America/Kentucky/Louisville
    America/Kentucky/Monticello
    America/Knox IN
    America/Kralendijk
    America/La Paz
    America/Lima
    America/Los Angeles
    America/Louisville
    America/Lower Princes
    America/Maceio
    America/Managua
    America/Manaus
    America/Marigot
    America/Martinique
    America/Matamoros
    America/Mazatlan
    America/Mendoza
    America/Menominee
    America/Merida
    America/Metlakatla
    America/Mexico City
    America/Miquelon
    America/Moncton
    America/Monterrey
    America/Montevideo
    America/Montreal
    America/Montserrat
    America/Nassau
    America/New York
    America/Nipigon
    America/Nome
    America/Noronha
    America/North Dakota/Beulah
    America/North Dakota/Center
    America/North Dakota/New Salem
    America/Nuuk
    America/Ojinaga
    America/Panama
    America/Pangnirtung
    America/Paramaribo
    America/Phoenix
    America/Port-au-Prince
    America/Port of Spain
    America/Porto Acre
    America/Porto Velho
    America/Puerto Rico
    America/Punta Arenas
    America/Rainy River
    America/Rankin Inlet
    America/Recife
    America/Regina
    America/Resolute
    America/Rio Branco
    America/Rosario
    America/Santa Isabel
    America/Santarem
    America/Santiago
    America/Santo Domingo
    America/Sao Paulo
    America/Scoresbysund
    America/Shiprock
    America/Sitka
    America/St Barthelemy
    America/St Johns
    America/St Kitts
    America/St Lucia
    America/St Thomas
    America/St Vincent
    America/Swift Current
    America/Tegucigalpa
    America/Thule
    America/Thunder Bay
    America/Tijuana
    America/Toronto
    America/Tortola
    America/Vancouver
    America/Virgin
    America/Whitehorse
    America/Winnipeg
    America/Yakutat
    America/Yellowknife
    Antarctica/Casey
    Antarctica/Davis
    Antarctica/DumontDUrville
    Antarctica/Macquarie
    Antarctica/Mawson
    Antarctica/McMurdo
    Antarctica/Palmer
    Antarctica/Rothera
    Antarctica/South Pole
    Antarctica/Syowa
    Antarctica/Troll
    Antarctica/Vostok
    Arctic/Longyearbyen
    Asia/Aden
    Asia/Almaty
    Asia/Amman
    Asia/Anadyr
    Asia/Aqtau
    Asia/Aqtobe
    Asia/Ashgabat
    Asia/Ashkhabad
    Asia/Atyrau
    Asia/Baghdad
    Asia/Bahrain
    Asia/Baku
    Asia/Bangkok
    Asia/Barnaul
    Asia/Beirut
    Asia/Bishkek
    Asia/Brunei
    Asia/Calcutta
    Asia/Chita
    Asia/Choibalsan
    Asia/Chongqing
    Asia/Chungking
    Asia/Colombo
    Asia/Dacca
    Asia/Damascus
    Asia/Dhaka
    Asia/Dili
    Asia/Dubai
    Asia/Dushanbe
    Asia/Famagusta
    Asia/Gaza
    Asia/Harbin
    Asia/Hebron
    Asia/Ho Chi Minh
    Asia/Hong Kong
    Asia/Hovd
    Asia/Irkutsk
    Asia/Istanbul
    Asia/Jakarta
    Asia/Jayapura
    Asia/Jerusalem
    Asia/Kabul
    Asia/Kamchatka
    Asia/Karachi
    Asia/Kashgar
    Asia/Kathmandu
    Asia/Katmandu
    Asia/Khandyga
    Asia/Kolkata
    Asia/Krasnoyarsk
    Asia/Kuala Lumpur
    Asia/Kuching
    Asia/Kuwait
    Asia/Macao
    Asia/Macau
    Asia/Magadan
    Asia/Makassar
    Asia/Manila
    Asia/Muscat
    Asia/Nicosia
    Asia/Novokuznetsk
    Asia/Novosibirsk
    Asia/Omsk
    Asia/Oral
    Asia/Phnom Penh
    Asia/Pontianak
    Asia/Pyongyang
    Asia/Qatar
    Asia/Qostanay
    Asia/Qyzylorda
    Asia/Rangoon
    Asia/Riyadh
    Asia/Saigon
    Asia/Sakhalin
    Asia/Samarkand
    Asia/Seoul
    Asia/Shanghai
    Asia/Singapore
    Asia/Srednekolymsk
    Asia/Taipei
    Asia/Tashkent
    Asia/Tbilisi
    Asia/Tehran
    Asia/Tel Aviv
    Asia/Thimbu
    Asia/Thimphu
    Asia/Tokyo
    Asia/Tomsk
    Asia/Ujung Pandang
    Asia/Ulaanbaatar
    Asia/Ulan Bator
    Asia/Urumqi
    Asia/Ust-Nera
    Asia/Vientiane
    Asia/Vladivostok
    Asia/Yakutsk
    Asia/Yangon
    Asia/Yekaterinburg
    Asia/Yerevan
    Atlantic/Azores
    Atlantic/Bermuda
    Atlantic/Canary
    Atlantic/Cape Verde
    Atlantic/Faeroe
    Atlantic/Faroe
    Atlantic/Jan Mayen
    Atlantic/Madeira
    Atlantic/Reykjavik
    Atlantic/South Georgia
    Atlantic/St Helena
    Atlantic/Stanley
    Australia/ACT
    Australia/Adelaide
    Australia/Brisbane
    Australia/Broken Hill
    Australia/Canberra
    Australia/Currie
    Australia/Darwin
    Australia/Eucla
    Australia/Hobart
    Australia/LHI
    Australia/Lindeman
    Australia/Lord Howe
    Australia/Melbourne
    Australia/NSW
    Australia/North
    Australia/Perth
    Australia/Queensland
    Australia/South
    Australia/Sydney
    Australia/Tasmania
    Australia/Victoria
    Australia/West
    Australia/Yancowinna
    Brazil/Acre
    Brazil/DeNoronha
    Brazil/East
    Brazil/West
    CET
    CST6CDT
    Canada/Atlantic
    Canada/Central
    Canada/Eastern
    Canada/Mountain
    Canada/Newfoundland
    Canada/Pacific
    Canada/Saskatchewan
    Canada/Yukon
    Chile/Continental
    Chile/EasterIsland
    Cuba
    EET
    EST
    EST5EDT
    Egypt
    Eire
    Etc/GMT
    Etc/GMT+0
    Etc/GMT+1
    Etc/GMT+10
    Etc/GMT+11
    Etc/GMT+12
    Etc/GMT+2
    Etc/GMT+3
    Etc/GMT+4
    Etc/GMT+5
    Etc/GMT+6
    Etc/GMT+7
    Etc/GMT+8
    Etc/GMT+9
    Etc/GMT-0
    Etc/GMT-1
    Etc/GMT-10
    Etc/GMT-11
    Etc/GMT-12
    Etc/GMT-13
    Etc/GMT-14
    Etc/GMT-2
    Etc/GMT-3
    Etc/GMT-4
    Etc/GMT-5
    Etc/GMT-6
    Etc/GMT-7
    Etc/GMT-8
    Etc/GMT-9
    Etc/GMT0
    Etc/Greenwich
    Etc/UCT
    Etc/UTC
    Etc/Universal
    Etc/Zulu
    Europe/Amsterdam
    Europe/Andorra
    Europe/Astrakhan
    Europe/Athens
    Europe/Belfast
    Europe/Belgrade
    Europe/Berlin
    Europe/Bratislava
    Europe/Brussels
    Europe/Bucharest
    Europe/Budapest
    Europe/Busingen
    Europe/Chisinau
    Europe/Copenhagen
    Europe/Dublin
    Europe/Gibraltar
    Europe/Guernsey
    Europe/Helsinki
    Europe/Isle of Man
    Europe/Istanbul
    Europe/Jersey
    Europe/Kaliningrad
    Europe/Kiev
    Europe/Kirov
    Europe/Lisbon
    Europe/Ljubljana
    Europe/London
    Europe/Luxembourg
    Europe/Madrid
    Europe/Malta
    Europe/Mariehamn
    Europe/Minsk
    Europe/Monaco
    Europe/Moscow
    Europe/Nicosia
    Europe/Oslo
    Europe/Paris
    Europe/Podgorica
    Europe/Prague
    Europe/Riga
    Europe/Rome
    Europe/Samara
    Europe/San Marino
    Europe/Sarajevo
    Europe/Saratov
    Europe/Simferopol
    Europe/Skopje
    Europe/Sofia
    Europe/Stockholm
    Europe/Tallinn
    Europe/Tirane
    Europe/Tiraspol
    Europe/Ulyanovsk
    Europe/Uzhgorod
    Europe/Vaduz
    Europe/Vatican
    Europe/Vienna
    Europe/Vilnius
    Europe/Volgograd
    Europe/Warsaw
    Europe/Zagreb
    Europe/Zaporozhye
    Europe/Zurich
    GB
    GB-Eire
    GMT
    GMT+0
    GMT-0
    GMT0
    Greenwich
    HST
    Hongkong
    Iceland
    Indian/Antananarivo
    Indian/Chagos
    Indian/Christmas
    Indian/Cocos
    Indian/Comoro
    Indian/Kerguelen
    Indian/Mahe
    Indian/Maldives
    Indian/Mauritius
    Indian/Mayotte
    Indian/Reunion
    Iran
    Israel
    Jamaica
    Japan
    Kwajalein
    Libya
    MET
    MST
    MST7MDT
    Mexico/BajaNorte
    Mexico/BajaSur
    Mexico/General
    NZ
    NZ-CHAT
    Navajo
    PRC
    PST8PDT
    Pacific/Apia
    Pacific/Auckland
    Pacific/Bougainville
    Pacific/Chatham
    Pacific/Chuuk
    Pacific/Easter
    Pacific/Efate
    Pacific/Enderbury
    Pacific/Fakaofo
    Pacific/Fiji
    Pacific/Funafuti
    Pacific/Galapagos
    Pacific/Gambier
    Pacific/Guadalcanal
    Pacific/Guam
    Pacific/Honolulu
    Pacific/Johnston
    Pacific/Kiritimati
    Pacific/Kosrae
    Pacific/Kwajalein
    Pacific/Majuro
    Pacific/Marquesas
    Pacific/Midway
    Pacific/Nauru
    Pacific/Niue
    Pacific/Norfolk
    Pacific/Noumea
    Pacific/Pago Pago
    Pacific/Palau
    Pacific/Pitcairn
    Pacific/Pohnpei
    Pacific/Ponape
    Pacific/Port Moresby
    Pacific/Rarotonga
    Pacific/Saipan
    Pacific/Samoa
    Pacific/Tahiti
    Pacific/Tarawa
    Pacific/Tongatapu
    Pacific/Truk
    Pacific/Wake
    Pacific/Wallis
    Pacific/Yap
    Poland
    Portugal
    ROC
    ROK
    Singapore
    Turkey
    UCT
    US/Alaska
    US/Aleutian
    US/Arizona
    US/Central
    US/East-Indiana
    US/Eastern
    US/Hawaii
    US/Indiana-Starke
    US/Michigan
    US/Mountain
    US/Pacific
    US/Samoa
    UTC
    Universal
    W-SU
    WET
    Zulu
    Filters:
    Training Formats
    Location
    Dates

    Register for FOR518

    • In Person

    Training events and topical summits feature presentations and courses in classrooms around the world.

    Learn more
    • Live Online

    Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

    Learn more
    • OnDemand

    Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

    Learn more

    Loading...