Mac I: Best Practices in Mac Forensics


This course shows you how and why you are missing evidence using Windows-based tools and how to find what is missed by using a Mac to process a Mac.

Steve Whalen developed the course to provide vendor neutral and tool agnostic training that covers the process of examining a Macintosh computer from the first step to the last step in logical order. The course was designed for both the beginner Mac examiner as well as the advanced. Surprising to most is that the entire course is taught using a Mac to examine a Mac without the use of expensive automated forensic tools. Even more surprising is that the participants realize that they can find more evidence and find it faster! Additionally, this course was designed with the understanding that many agencies are dealing with limited budgets.

Topics include but are not limited to:

  • Overview of macOS Versions – identifies features of forensic importance in different macOS and when they appeared
  • Understanding the Mac File System Technology – a review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives and macOS Extended
  • Intel Mac Technology and Bootcamp – explains the forensic significance of Mac Intel Technology
  • Mac Security Issues and FileVault Attacks – current best practices for dealing with Mac Security
  • Macintosh Search and Seizure – best practices for seizing Mac and iOS hardware
  • Safely Obtaining System Information – how to safely obtain system information without making changes to the evidence
  • Bypassing Open Firmware Passwords – explains OFP, how to remove OFP and if it is Necessary
  • Volatile Data Collection – how to build Trusted Utilities Disk and using it to collect volatile Information
  • Manual and Automated Imaging and Acquisition – using the Mac to safely image media both manually and with PALADIN
  • Imaging Mac RAM – exercises in imaging Mac RAM and recovering passwords
  • Verifying and Safely Mounting Forensic Images – safely mounting forensic images for Processing
  • Indexing Forensic Images – how to index forensic images using macOS
  • Search Techniques Using macOS – creating custom search expressions 
from the command-line and GUI
  • Locating Evidence (Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs and more) – identifying Mac artifacts in the file system
  • Recovering Deleted Files – an exercise in manually recovering deleted files and the dangers of Mac optimization
  • Examining SQLite Databases and PLIST files – examining the heart of Mac data storage
  • Using macOS for Forensics – how to utilize built-in macOS technology for forensics
  • Report Development – how to create native reports using the Mac to properly view data
  • Examining iOS Devices Artifacts – identifying and examining iOS artifacts found on a Mac
  • Working with NTFS – integrating Mac forensics in a Windows centric forensic lab
  • Review of Recommended Applications – our recommendations for commercial and non-commercial tools to assist with Mac forensics
  • Review of Automated Forensic Tools – our review of current automated Mac forensic tools
  • Recommended Macintosh Hardware Requirements for Forensics – recommendations of hardware for Mac forensics




Existing IACIS members simply log in with your credentials and go to the products page to purchase and register for the course.

For non-IACIS members, the membership fee is waived with the purchase of the training course; however, to register for the course you must complete a membership application at the time of purchase.

Apply for membership and purchase the course on the PRODUCTS PAGE.

COST: $1,495 US Dollars

  • Cancellation of this class may occur if there are insufficient students registered. In the event of a cancellation, personnel will typically be notified by email within 48 hours of the registration closure date. IACIS is not responsible for any individual expenses incurred as a result of a cancellation. The limit of IACIS financial liability is a full refund of the course fee.

****Payment MUST BE RECEIVED at least 45 days prior to the first day of class. Any payment arrangements other than payment through the website or payment via invoice must be approved by the IACIS Treasurer prior to admittance into the course. Please contact the treasurer for questions and approval (  Cancellations within 45 days from the start of class to 30 days from the start of class will be subject to a $150 cancellation fee. There will be no refunds within 30 days from the start of class.****

* On-Site Check-in Times (student pickup of equipment, ID card, IACIS info) are:

             Sunday, April 26, 2020 : 1800 – 2100

             Monday, April 27, 2020: 0700 – 0800

* Please make arrangements to arrive in time to check-in so that you may be in class promptly the first day.


Please read the following notes regarding this class:

  1. Classes begin at 8:00 AM ET and conclude at 5:00 PM ET, each day, with a one hour lunch break. Classes will end at 4:00 PM ET on the last day of class. Please do not arrange for departing flights prior to 7:00 PM ET to allow time for travel to the airport and any security clearances.
  2. The dress code for the conference is business casual (collared shirts and slacks).The wearing of shorts, flip flops, tank tops, etc. is not allowed in the classroom. Personal computers are not permitted in the classroom. Students are required to attend all classes to successfully complete the program. Students who fail to meet the attendance requirements will not be issued a certificate at the conclusion of the program.


The 2020 course will be taught at the Caribe Royale Hotel, 8101 World Center Drive, Orlando, Florida 32821 (USA).  This hotel is close to the Orlando International Airport, has a large pool, spacious workout facility and is very close to Disney World and Universal Studios.

BOOK HERE or via phone by calling the following numbers:

Reservations Toll Free: 1-800-823-8300 or our local number 407-238-8000.

Rates are good for 4/17 – 5/9/2020 while room supplies last