MFSC-201: Online, Eastern Daylight Time
October 20 - October 24
$3,199.00
Advanced Practices in Mac Forensics will be presented by SUMURI from October 20 – 24 2025, 8:00 AM to 5:00 PM EST.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.
MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!
Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.
Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.
Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.
Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.
Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.
Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.
Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.
Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.
Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.
Understand the Time Machine backup process and structure in order to find data.
Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.
Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.
Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.
