Major Update

FOR518: Mac and iOS Forensic Analysis and Incident Response

GIAC iOS and macOS Examiner (GIME)
GIAC iOS and macOS Examiner (GIME)
  • In Person (6 days)
  • Online
36 CPEs

FOR518 is the first non-vendor-based Mac and iOS incident response and forensics course that focuses students on the raw data, in-depth detailed analysis, and how to get the most out of their Mac and iOS cases. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. 23 Hands-On Labs

What You Will Learn

Digital forensic and incident response investigators have traditionally dealt with Windows machines, but what if they find themselves in front of a new Apple Mac or iOS device? The increasing popularity of Apple devices can be seen everywhere, from coffee shops to corporate boardrooms. Dealing with these devices as an investigator is no longer a niche skill - every analyst must have the core skills necessary to investigate the Apple devices they encounter.

This consistently updated FOR518 course provides the techniques and skills necessary to take on any Mac or iOS case without hesitation. The intense hands-on forensic analysis and incident response skills taught in the course will enable analysts to broaden their capabilities and gain the confidence and knowledge to comfortably analyze any Mac or iOS device. In addition to traditional investigations, the course presents intrusion and incident response scenarios to help analysts learn ways to identify and hunt down attackers that have compromised Apple devices.

"Again, SANS proves to provide the best technical training the market has to offer. Sarah has put together a comprehensive, coherent, challenging, and downright fun (is convivial too much?) course to attend. The FOR518 is everything I wanted it to be and so much more. I realize only now how apt a phrase "Impera Magis, Aliter Cogita" truly is: if you want to be successful at this course, embrace the command line, and abandon all ye know of Windows, because this is a different OS. I am thrilled to be taking this course and can't wait to dive even deeper into the limitless nuance MacOS & iOS forensics have to offer."

What Is macOS and iOS Forensics Analysis?

MacOS and iOS Forensic Analysis is the recovery, analysis, and interpretation of data stored on Apple devices.

Business Takeaways

  • Empower employees to investigate various crimes such as computer misuse, malicious device intrusions, corporate espionage, insider threats, and fraud.
  • Learn how various Apple data is stored and how to analyze using tool agnostic methods without the requirement for expensive commercial forensic tools.
  • Identify different forensic artifacts and nuances between the Apple platforms (macOS and iOS).
  • Understand the wealth of user related information that can show how a device was used or abused.
  • Learn the differences of performing forensics and security assessments when Apple devices are involved versus other industry-standard operating systems.

Skills Learned

  • Understand the nuances between macOS and iOS devices
  • Dive into how the Apple magic works between devices, and how that can help investigations
  • Determine the importance of each file system domain and how data is organized
  • Conduct temporal analysis of a system by correlating data files and log analysis
  • Profile how individuals used the system, including how often they used the system, what applications they frequented, and their personal system preferences
  • Identify remote or local data backups, disk images, or other attached devices
  • Find encrypted containers and FileVault volumes, understand keychain data, and crack Mac passwords
  • Analyze and understand macOS metadata and their importance in the Spotlight database, Time Machine, and Extended Attributes
  • Develop a thorough knowledge of the Safari Web Browser, Apple Mail and many more applications by looking that their internal databases
  • Identify communication with other users and systems though Messages, FaceTime, SSH remote login, Screen Sharing, and AirDrop
  • Conduct an intrusion analysis of an Apple devices for signs of compromise or malware
  • Understand the APFS file system and its significance with a bonus Lab to parse the APFS file system by hand, using only a reference sheet and a hex editor
  • Understand how the Apple Ecosystem of devices work and interact with each other. From AirTags, to VisionPro, to the Apple Watch, to HomeKit - all these Apple technologies will have artifacts on macOS and iOS devices.

Hands-On macOS and iOS Forensics Training

The hands-on portion of FOR518 is unique and especially suited to those who love to dig into the data. The labs were created to show how Apple data is stored and how to interpret it without the need for an expensive commercial utility. These labs will allow a student to get a hands-on perspective of the data that is shown in the class presentations and apply the concepts to the course dataset. The labs in this course are a major component of the learning experience and enables the student to increase their success in applying various analysis course topics after they leave the classroom.

"Labs were very accurate and relevant to the topics we were learning during class. Very entertaining, interesting and challenging."

"The exercises were complicated, but the walkthroughs and questions were easily digestible, which is hard to do! Some of the more recent classes I've taken had such complicated labs that you couldn't easily track back to a mistake. Sarah's designed the labs to be just as complicated, if not more so, while using language, and questions, to make troubleshooting so much easier."

"Really enjoyed the labs, love that it's highly encouraged to use the command line tools. Nothing against any vendor and their GUI, but my goal since starting in cyber security was to use the command line as much as possible (without being impractical). This course is a master class in that."

Syllabus Summary

  • Section 1: An introduction to the Apple platforms including data storage, file analysis, and data interpretation.
  • Section 2: Log analysis and review of various user and system settings.
  • Section 3: It's all about the metadata stored within multiple file system artifacts.
  • Section 4: Every application is different, review how each app stores it's data.
  • Section 5: All other things; from pattern of life analysis, to password cracking, to malware, and "one more thing!"
  • Section 6: The Apple Forensics Challenge, take what you learn in class and compete in a CTF-style challenge against others.

Additional Free Resources

What You Will Receive

  • Course ISOs loaded with dataset and tools.
  • MP3 audio files of the complete course lecture

Course topics

  • Advanced Computer Forensics Methodology
  • Apple Specific Acquisition and Live Response Collection
  • File System Data Analysis
  • Metadata Analysis
  • Recovery of Key Mac and iOS Files
  • Database Analysis
  • Volume and Disk Image Analysis
  • Analysis of Mac Technologies, including Time Machine, Spotlight, and FileVault
  • Analysis of Apple Devices including AirTags, Apple Watch, FindMy, HomeKit as they interact with the macOS and iOS counterparts
  • Advanced Log Analysis and Correlation
  • In-Depth APFS File System Examination

What Comes Next?

Depending on your current role or future plans, one of these courses is a great next step in your digital forensics and incident response journey:

Syllabus (36 CPEs)

Download PDF
  • Overview

    This section introduces the student to Mac and iOS essentials such as acquisition, timestamps, logical file system, and disk structure. Acquisition fundamentals are the same with Mac and iOS devices, but there are a few tips and tricks that can be used to successfully collect Mac and iOS systems for analysis. Students comfortable with Windows forensic analysis can easily learn the slight differences on a Mac system - the data are the same, only the format differs.

    • Course Lab Setup
    • Disks and Volumes
    • Mount and Review Acquisitions
    • Triage
    • Forensic Testing
    • Apple Essentials and Device Security
      • Platform and Versions
      • Timestamps
      • File Types
      • Security Concepts
    • Disks and Volumes
      • Disk and Volume Structures
      • GPT and other partitioning schemes
      • FileVault & Hardware Encryption
      • Disk Images
      • APFS Containers
    • macOS Acquisition Tools and Methods
      • Acquisition Pitfalls and Considerations
      • Commercial and Free Tools
      • Volatile Data
      • Memory Acquisition & Analysis
    • iOS Acquisition Tools and Methods
      • Commercial and Free Tools
      • Jailbreaks
      • Acquisition Types and Differences
      • Local and iCloud Backups
      • Sysdiagnose Files
      • Tools for Acquisition and Analysis
    • Data Organization, Triage, and iCloud
      • Domain Organization of Data
      • Containers and Sandboxing
      • iOS Backup Normalization
      • Application Data Structure
      • Triage Analysis
      • Accounts
      • iCloud
    • Forensic Testing
      • Device Setup
      • Tools - Corellium, Free, and Open-source
      • SQLite Database Queries
      • Database Structures
  • Overview

    Mac and iOS devices contain many system settings that can show how a device was used (or abused). A user of the device may change a specific configuration that can provide useful forensic insight. Often these configuration actions can be also found in the logs and provide historical context to create a detailed story of how the device was used.

    This section focuses on system and data configurations alongside log analysis. These devices have many different types of logs each with their own method for analysis and content. The log entries can be correlated with user and system data found on the system to create an in-depth timeline that can be used to solve cases quickly and efficiently.

    • Parsing System Logs
    • User Artifacts and User Interface
    • Volumes, Printing, and System State
    • Network and Bluetooth
    • Parsing System Logs
      • Log Basics
      • Log Types (Unix, BSM Audit, Apple System Logs (ASL) and Unified)
      • Log Configuration
      • Analysis Methods and Parsing Tools
    • User Account
      • Deleted Users
      • User Logins
      • Privilege Escalation
      • Most Recently Used Items (MRUs)
      • NSKeyedArchiver Plist Files
      • Managed Users
    • User Interface
      • Keyboard
      • Notifications
      • iOS Springboard
      • macOS Finder
      • Saved Application State
    • Volumes
      • Log and File Analysis
      • Connected Devices
      • Network Shares
    • Printing
      • Control Files
      • Data Files
    • System State
      • Log and File Analysis
    • Network
      • Device Configuration
      • Cellular Data
      • Wi-Fi Access Point Connections
      • Remote Access
      • Log and File Analysis
    • Bluetooth
      • Device Connections
      • Apple Continuity Technology
      • AirDrop
      • Log and File Analysis
  • Overview

    After a review of how APFS works, students will look at a variety of fascinating artifacts that are used by the file system and that are quite different from other operating systems students have seen in the past. This includes many artifacts that contain metadata and can provide more context into investigations.

    In an additional bonus lab students will learn the building blocks of Mac and iOS forensics with a thorough deep-dive understanding of the Apple File system (APFS). Utilizing a hex editor, students will learn the basic structures of the primary file system implemented on MacOS and iOS systems.

    • Parsing APFS (Bonus)
    • Disk and Volume Artifacts
    • Extended Attributes
    • Spotlight
    • Document Versions
    • FSEvents
    • Volume File System Artifacts
      • Overview of APFS
      • Data Structures
      • APFS Benefits and Caveats
      • APFS Clones
      • APFS Snapshots
      • Artifacts Left Behind by Macs
      • Differences from Various File Systems
      • DS_Store Files
      • APFS analysis with The Sleuth Kit (TSK)
    • Extended Attributes
      • Contents
      • Analysis
      • Forensically Useful Attributes
    • Spotlight
      • Indexed Items
      • Analysis Methods and Tools
      • Practical Queries
    • Document Versions
      • Versions Metadata
      • Versions Database
      • Generations
      • Chunk Storage
    • File System Events Store Database (FSEvents)
      • Usage
      • Parsing with Tools
      • Practical Analysis
  • Overview

    In addition to all the configuration and preference information found in the User Domain, the user can interact with a variety of native Apple applications, including the Internet, email, communication, photos, locational data, and others. These data can provide analysts with the who, what, where, why, and how for any investigation.

    This section will explore the various databases and other files where data are being stored. The student will be able to parse this information by hand without the help of a commercial tool parser.

    • Application Fundamentals
    • Safari and Wallet
    • Mail and Communication
    • Notes, Photos, Maps
    • Application Fundamentals
      • Application Bundles
      • Mach-O Executables
      • Extensions
      • Software Updates
      • iOS Application Snapshots
      • Permissions
    • Safari Browser
      • History
      • Cache
      • Session Data
    • Wallet
      • Cards
      • Passes
      • Transactions
    • Mail
      • Email Files
      • Attachments
      • Downloaded Items
    • Communication
      • Messages
      • FaceTime
      • Call History
      • Voicemail
    • Notes
      • Database Analysis
      • Protobufs
    • Photos
      • Media Analysis
      • Photo Metadata
    • Maps
      • Database Analysis
      • Protobufs
  • Overview

    Apple systems implement some technologies that are available only to those with Mac and iOS devices. In this section, students will learn about a variety of topics that can be used in a variety of investigations. Topics such as pattern of life will detail very specific user and device activities which can determine which app was being used at precise time, how many steps did they walk, was the device unlocked, or where the device was. Other advanced topics include cracking into data hidden in encrypted containers, indicators of compromise, security enhancements, and all other Apple "things" including FindMy, AirTags, TimeMachine and more!

    • Pattern of Life
    • Password Cracking
    • Malware and Live Response
    • One More Thing (Other Apple Technology)
    • Pattern of Life
      • Screen Time
      • KnowledgeC
      • Biomes
      • Power Logs
      • Application Usage
      • Media Usage
      • Device Status
      • Health
      • Location Data
    • Password Cracking
      • Password Shadow Files
      • Cracking Passwords
      • Keychains
      • FileVault
      • Dictionary Files
      • Encrypted Disk Images
    • Malware and Live Response
      • Malware Examples
      • File Quarantine
      • XProtect
      • Gatekeeper
      • Notarization
      • Autoruns
      • Firewall Settings
      • Velociraptor
    • One More Thing
      • Time Machine
      • Apple Watch
      • CarPlay
      • FindMy
      • AirTags
      • HomeKit
      • VisionPro
  • Overview

    In this final course section, students will put their new All-Things-Apple forensic skills to the test by running through a real-life scenario.

    • In-Depth File System Examination
    • File System Timeline Analysis
    • Advanced Computer Forensics Methodology
    • File System Data Analysis
    • Metadata Analysis
    • Recovering Key Mac Files
    • Database Analysis
    • Volume and Disk Image Analysis
    • Analysis of Apple-specific Technologies
    • Advanced Log Analysis and Correlation

GIAC iOS and macOS Examiner

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

  • Mac and iOS File Systems, System Triage, and Application Data
  • Mac and iOS Incident Response, Malware, and Intrusion Analysis
  • Mac and iOS User Data and Timeline Analysis
More Certification Details


Working knowledge of forensics and the Unix command line is very useful! You can familiarize yourself with the Unix command line with these tutorials:

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MAC hardware is required for this course. The labs cannot be performed on anything other than native MAC hardware
  • 16GB of RAM or more is required.
  • 200GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Additional requirements for this course:

  • Apple MacOS 12 or newer is required.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"This course is designed to enable an analyst comfortable in Windows-based forensics to perform just as well on a Mac. The Mac and iOS market share is ever-increasing, and the Apple is now a popular platform for many companies and government entities. I believe a well-rounded forensic analyst is an extremely well-prepared and employable individual in a Windows forensics world. Windows analysis is the base education in the competitive field of digital forensics, but any additional skills you can acquire can set you apart from the crowd, whether it is Mac, mobile, memory, or malware analysis.

Mac and iOS forensics is truly a passion of mine that I genuinely want to share with the forensics community. While you may not work on a Mac or iOS investigation every day, the tools and techniques you learn in this course will help you with other investigations including Windows, Linux, and mobile."

- Sarah Edwards

"FOR518 is a great course for forensics people and organizations that use Mac within their environments, and the labs were really engaging. Sarah is an expert in this field and a great instructor, and she's really responsive to our comments and questions." - Ali Memarzia, Google


It was very interesting to learn that certain 'forensic' tools could report data as being encrypted even though one could still get other data.
Gary Titus
Stroz Friedberg LLC
Really excellent course. Fantastic resource in the classroom material. Forensic challenge the last day was very fun.
This is the most comprehensive Mac class I've taken.
Daniel M.
US Federal Agency

    Register for FOR518

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.