0345 4506120

Certified Mac Forensics Specialist - Mac Forensics Investigation

This 3 day course will provide you with an understanding of the underlying data structures of Apple devices and many OS X / iOS specific forensic artefacts.

The course concentrates on identifying the what is, how can I find, extract, decode and interpret the data stored on an Apple device from a forensic practitioner’s perspective. You will be introduced to new material and have an opportunity to apply this in hands-on exercises to demonstrate and reinforce understanding

Target Audience

This course is aimed at forensic investigators who have gained experience dealing largely with Windows based systems and are now in the situation where they increasingly need to understand and be confident about the data structures and evidence potential in Mac OSX and iOS environments.


Learning Objectives

This Mac forensics training course gives delegates a practical understanding of:

  • Data structures and potential evidence as produced in Apple Mac OS X environments
  • Implementing forensic tools on Mac OS X-based file systems


Knowledge of the principles and general guidelines surrounding forensic investigation

A basic knowledge of data structures e.g. binary and hexadecimal

Course Content

  • An introduction to Apple
  • Apple Forensic Basics
  • Seizure and Imaging – OSX and iOS devices
  • Apple Disk Partitioning – APM and GPT
  • File systems - compatibility
  • A detailed look at HFS+ from a forensic perspective
  • System Configuration – e.g. disk formatting, OS installation and networking
  • User Accounts – configuration, passwords and file vault
  • Files Behind the Scenes – including log files, printing and trash
  • Examining iOS - including WebKit and App security
  • Common Applications – including Office and Safari
  • Time Machine – Functionality and data structures
  • Consideration in an Incident Response scenario

Exams & Certification

Delegates who successfully complete the exam included at the end of the training course will be awarded the Certified Mac Forensics Specialist (CMFS) qualification.

Privacy Notice

In order to provide you with the service requested we will need to retain and use your contact information in accordance with our Privacy Notice. If you choose to provide us with this information you explicitly consent to us using the information as necessary to provide the request service to you. If you do not agree please do not proceed to request the service from us.

Marketing Permissions

Would you like to receive our newsletter and other information on products and services which we think will be of interest to you by email. We will always treat your information with care and in accordance with our Privacy Notice. You are free to withdraw this permission at any time.


Online Courses

You may prefer an online course if you are looking for a flexible and cost-effective solution. Online courses allow you to study at your own pace, at a time that suits you.

We have the following eLearning options available:

Our Customers Include