0845 450 6120

Certified Mac Forensics Specialist - Mac Forensics Investigation

This 3 day course will provide you with an understanding of the underlying data structures of Apple devices and many OS X / iOS specific forensic artefacts.

The course concentrates on identifying the what is, how can I find, extract, decode and interpret the data stored on an Apple device from a forensic practitioner’s perspective. You will be introduced to new material and have an opportunity to apply this in hands-on exercises to demonstrate and reinforce understanding

Target Audience

This course is aimed at forensic investigators who have gained experience dealing largely with Windows based systems and are now in the situation where they increasingly need to understand and be confident about the data structures and evidence potential in Mac OSX and iOS environments.


Learning Objectives

This Mac forensics training course gives delegates a practical understanding of:

  • Data structures and potential evidence as produced in Apple Mac OS X environments
  • Implementing forensic tools on Mac OS X-based file systems


Knowledge of the principles and general guidelines surrounding forensic investigation

A basic knowledge of data structures e.g. binary and hexadecimal

Course Content

  • An introduction to Apple
  • Apple Forensic Basics
  • Seizure and Imaging – OSX and iOS devices
  • Apple Disk Partitioning – APM and GPT
  • File systems - compatibility
  • A detailed look at HFS+ from a forensic perspective
  • System Configuration – e.g. disk formatting, OS installation and networking
  • User Accounts – configuration, passwords and file vault
  • Files Behind the Scenes – including log files, printing and trash
  • Examining iOS - including WebKit and App security
  • Common Applications – including Office and Safari
  • Time Machine – Functionality and data structures
  • Consideration in an Incident Response scenario

Exams & Certification

Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Mac Forensics Specialist (CMFS) qualification.

One Month
Two Months
Three Months
More than Three Months
PRINCE2 Foundation & Practitioner
MSP Foundation & Practitioner
APMP Certificate
ITIL Foundation
Scrum in One Day
Certified ScrumMaster
ISTQB Software Test Foundation
Microsoft Project
BCS Business Analysis Practice
Other - Please Specify Below

Online Courses

You may prefer an online course if you are looking for a flexible and cost-effective solution. Online courses allow you to study at your own pace, at a time that suits you.

We have the following eLearning options available:

Our Customers Include