Page Loader Logo

The International Association of Computer Investigative Specialists

MFSC-201: The Advanced Practices in Mac Forensics

MFSC-201 Course Overview

This course is given by SUMURI. As each quarter passes, Apple’s success has been nothing but impressive. In addition to desktop and mobile computers, Apple produces a variety of unique and innovative devices and applications found in just about every modern society, home, and business. As more and more Apple devices enter the marketplace exponentially, the need for Macintosh Forensic Training is quite apparent.

The Advanced Practices in Mac Forensics (MFSC-201) course provides unparalleled vendor-neutral and tool-agnostic instruction in advanced topics relating to the forensic use and analysis of Apple hardware, technologies, and applications. The training is designed for the participant to learn in a teamwork environment and is taught by instructors who maintain a “no one left behind” attitude. In addition, complicated topics are made easy to understand through instructor-led exercises and real-life scenarios— supported by a quality student manual to be utilized as a supplemental resource after the course.

MFSC-201 is the second prerequisite for the Certified Forensic Mac Examiner certification. The CFME is a two-part certification process that tests the candidate on topics covered in MFSC-101 and MFSC-201. It is absolutely at no extra cost to those candidates who have attended both of the courses.

NOTE: Each student is required to supply their own Mac computer for the class. The Mac should be able to run the current release of MacOS.

More Details

Completion of MFSC-101 or comparable Mac Forensics Course

  • Advanced File System Analysis: Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.
  • Advanced Command Line: Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.
  • macOS Log Analysis: Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.
  • File System Event Monitoring and Analysis: Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.
  • Identifying and Analyzing Virtual Machines: Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.
  • AppleScript and Automator: Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.
  • macOS Server & Software RAIDs: Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.
  • Macintosh Timeline Analysis: Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.
  • iCloud Forensics: Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.
  • Time Machine Analysis: Understand the Time Machine backup process and structure in order to find data.
  • Unique Apple Technology: Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.
  • Advanced Search Techniques: Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.
  • Application Deconstruction: Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled applications.

Quick Details

Apply knowledge towards:

CFCE IACIS Certification

CFCE

Certified Forensic Computer Examiner Program

CAWFE IACIS Certification

ICMDE

Certified Mobile Device Examiner

CMDE IACIS Certification

CAWFE

Certified Advanced Windows Forensic Examiner

Upcoming events Details of the next event for this course

Where and When is the MFSC-201 Course Offered?

IACIS offers the CIFR course at multiple locations, accommodating the varied schedules of our professional audience. For course dates and locations, please visit our EVENTS page.

How to Register for this Course

Existing IACIS members, simply log in with your IACIS credentials and go to the PURCHASE TRAINING page to purchase and register for the course.

For non-IACIS members, the membership fee is waived with the purchase of the training course; however, to register for the course you must complete a membership application at the time of purchase. Go to the PURCHASE TRAINING page to purchase and register for the course and complete your membership application.

Skip to content