MFSC-101: Online, Eastern Standard Time
Best Practices in Mac Forensics will be presented by SUMURI from February 09 – 13, 2026, 8:00 AM to 5:00 PM EST.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!
MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-
Start your journey to certification and elevate your expertise today!
Identifies features of forensic importance in different macOS and when they appeared
A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended
Explains the forensic significance of Mac Intel Technology
Explains the unique issues and forensic significance of M1 Silicon Technology
Current best practices for dealing with Mac Security
Best practices for seizing Mac and iOS hardware
How to safely obtain system information without making changes to the evidence
Explains OFP, how to set and remove OFP if it is necessary
Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk
Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features
Discussion on the challenges in capturing RAM due to macOS security features
Safely mounting forensic images for Processing and analysis
How to index forensic images using macOS
Creating custom search expressions from the command-line and GUI
How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more
An exercise in manually recovering deleted files and the dangers of Mac optimization
Examining the heart of Mac data storage
How to utilize built-in macOS technology for forensics
How to create native reports using the Mac to view data properly
Our recommendations for commercial and non-commercial tools to assist with Mac forensics.
