MFSC-101: Orlando, Florida
2024-04-22 - 2024-04-26 | Caribe Royale Hotel, 8101 World Center Drive, Orlando, FL, United States
SOLD OUT
Best Practices in Mac Forensics will be presented by SUMURI at the IACIS Training Event on April 22 – April 26, 2024
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!
MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/

National Cyber Crime Conference
2024-04-23 - 2024-04-25 | Four Points by Sheraton Norwood, 1125 Boston-Providence Turnpike, Norwood, MA
2024 marks the 13th Anniversary of the National Cyber Crime Conference. Join SUMURI from April 23 to April 25, 2024 for one of the premier training events for law enforcement investigators, prosecutors, and forensic examiners worldwide. The 2024 National Cyber Crime Conference offers hundreds of sessions covering diverse digital evidence and cybercrime topics, presented by top experts in the field.
Don’t miss the chance to gain insights from Jason Roslewicz, SUMURI’s VP for Business Development, as he shares his expertise.
These three days offer invaluable opportunities for learning, networking, and advancing in the fields of cybercrime investigation and digital forensics.

Speaking Engagement:
Optimize Your Mobile Investigations by Minimizing Filter Driver Conflicts
Jason Roslewicz, VP for Business Development

International Association for Computer Investigative Specialists (IACIS) Conference
2024-04-25 - 2024-04-29 | Caribe Royale Hotel, 8101 World Center Drive, Orlando , FL
SUMURI is a long-time partner and supporter of the International Association of Computer Investigative Specialists. In support of IACIS’ mission to provide quality digital forensics and Incident Response training at an affordable cost, SUMURI will again be presenting Best Practices in Mac Forensics (MFSC-101) and Advanced Practices in Mac Forensics (MFSC-201) at the 2024 IACIS Orlando Training Event at Caribe Royale Orlando.
SUMURI will be showcasing our groundbreaking forensics workstation – TALINO and Mac Forensic Course. Stop by the SUMURI booth on April 25, 26, and 29, 2024, and see the latest and greatest in the DFIR world.

MFSC-201: Orlando, Florida
2024-04-29 - 2024-05-03 | Caribe Royale Hotel, 8101 World Center Drive, Orlando , FL
SOLD OUT
Advanced Practices in Mac Forensics will be conducted by SUMURI at the IACIS Training Event on April 29 – May 3, 2024
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics course. MFSC-201 focuses on in-depth analysis techniques, which provides the students the ability to apply what they have learned in real-world cases.
MFSC-201 covers topics such as Time Machine Analysis, iCloud Forensics, Application Deconstruction, File System Event, and Scripting and Automation. The knowledge you gain from our training can be applied to any forensic tool on any platform.
SUMURI’s Mac Forensic Survival Courses (MFSC) provide vendor-neutral training that covers the process of examining a Mac computer from the first step to the last step, in logical order. No sales pitch, just Mac Forensics!
MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/

Techno Security and Digital Forensics Conference – East
2024-06-03 - 2024-06-06 | Wilmington Convention Center, 10 Convention Center Dr, Wilmington, NC 28401, USA, Wilmington, NC, United States
SUMURI, an acclaimed leader in digital forensics, is proud to announce its platinum sponsorship at the Techno Security & Digital Forensics Conference in Wilmington, North Carolina, from June 3rd to 6th, 2024.
Explore our newest innovation, the KA-Desktop, a compact yet powerful addition to our renowned TALINO Workstation lineup. Visit us at Booth 100 to meet our team and gain insights into how our cutting-edge technology can enhance your investigative endeavors.
Join us at the event to discover how SUMURI continues to revolutionize the digital forensics landscape.

National Law Enforcement Training on Child Exploitation
2024-06-11 - 2024-06-13 | Hilton Atlanta, 255 Courtland St NE, Atlanta, GA 30303, Atlanta, GA, United States
Join SUMURI, the renowned award-winning digital forensics company, at Booth 102 as we proudly participate in the prestigious 2024 National Law Enforcement on Child Exploitation, taking place at the Hilton in Atlanta, Georgia, from June 11 to 13, 2024.
The National Law Enforcement Training on Child Exploitation is a national training event designed to expand the efforts and knowledge base of law enforcement investigators and prosecutors by providing specialized training focused on investigating and prosecuting technology-facilitated crimes against children.
As part of SUMURI’s commitment to empowering organizations with cutting-edge solutions, we are delighted to offer a Free Product and Mac Forensics Training Consultation.
Meet our TALINO Sales and Support Manager, Dan Erickson, and Software Support Specialist, Justin Henschen, to discuss how our products can enhance your digital forensics capabilities.

Forensic Europe Expo
2024-06-19 - 2024-06-20 | ExCeL London, Royal Victoria Dock, 1 Western Gateway, Royal Docks, London E16 1XL, UK, London, England, E16 1XL, United Kingdom
SUMURI, an award-winning digital forensics company, will be joining Insig2 at Excel London from June 19 – 20, 2024, booth FEE630.
Increasing globalization has facilitated a more complex form of crime that does not respect national borders. SUMURI will, once again, bring its award-winning lineup of Software and Hardware solutions to Europe to assist in the fight.
Free Product Consultation will be given by our Senior Forensic Specialist, Chris Grettenberger. If you want to know more about the conference, please visit this link: https://forensicseuropeexpo.com

MFSC-101: Online, Europe
2024-06-24 - 2024-06-28 | FL
Best Practices in Mac Forensics will be presented by SUMURI from June 24 – 28, 2024, 8:00 AM to 5:00 PM CEST.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
This course is open for registration and will be taught in the Central European Summer Time Zone.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

MFSC-201: Online, Europe
2024-07-08 - 2024-07-12 | FL
Advanced Practices in Mac Forensics will be presented by SUMURI from July 8 – 12, 2024, 8:00 AM to 5:00 PM CEST.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
MFSC-201 covers topics such as Time Machine Analysis, iCloud Forensics, Application Deconstruction, File System Events, and Scripting and Automation. Completion of MFSC-101 (or comparable Mac Forensics course) is strongly recommended before taking MFSC-201. The knowledge you gain from our training can be applied to any forensic tool on any platform.
SUMURI’s Mac Forensic Survival Courses (MFSC) provide vendor-neutral training that covers the process of examining a Mac computer from the first step to the last step, in logical order. No sales pitch, just Mac Forensics!

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
This course is open for registration and will be taught in the Central European Summer Time Zone.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

40th Annual HTCIA Global Training Event
2024-07-24 - 2024-07-25 | Planet Hollywood, Las Vegas, Nevada, 3667 Las Vegas Boulevard South, Las Vegas, NV, 89109, United States
SUMURI, an award-winning digital forensics company will participate the 40th Annual HTCIA Global Training Event in Las Vegas, Nevada from July 24th to 25th at Booth Number 5.
Meet our Co-Founder, Steve Whalen, and Senior Forensic Specialist, Chris Grettenberger to discuss our solutions firsthand, and learn how our products can enhance your investigative capabilities.

July 24: "Mastering Live Volatile Data Collection on Macs" by Steve Whalen at Sunset 6

This workshop invites you to bring your own Mac for an immersive, practical experience. We’ll dive into the specifics of macOS, exploring how to manually collect key forensic data like active network connections, running processes, and user session information, using the unique features and utilities inherent to macOS. This session is designed to equip you with the skills to navigate and investigate the complexities of macOS in live forensic scenarios. As the workshop unfolds, you’ll understand why Macs, with their distinct operating system and security features, are increasingly significant in digital investigations. The workshop goes beyond technical skill-building; it’s an opportunity to grasp the practical implications of forensic techniques on Macs. By joining us, you’ll gain deeper insight into macOS forensics, enhance your professional capabilities, and network with fellow experts, all while gaining practical skills that are directly transferable to your role in computer forensics.

Part 1 at 2:15pm-3:15pm (Sunset 6)

Part 2 at 3:45pm-4:45pm (Sunset 6)

July 25: "Unlocking Digital Forensics with PALADIN - a Hands-On Workshop by Steve Whalen at Sunset 3

Dive into the world of digital forensics with our interactive workshop at the HTCIA International Conference, featuring the powerful tool PALADIN. PALADIN is a versatile and user-friendly forensic suite built on a Ubuntu Linux foundation, renowned for its ability to simplify complex forensic tasks. This workshop is your gateway to mastering both basic and advanced features of PALADIN, including its intuitive graphical user interface, robust imaging capabilities, and the comprehensive PALADIN Toolbox. Our session will guide you through the essentials of using PALADIN for forensic imaging, data triage, and advanced analysis. You’ll learn to navigate its features, from creating forensic copies of data to leveraging the Toolbox for deeper investigations. We’ll explore how PALADIN streamlines the process of acquiring and analyzing digital evidence, making it an invaluable asset for forensic professionals. As a bonus, the first 50 attendees will receive their own PALADIN USB drive to keep, pre-loaded with the latest version of the tool, allowing you to immediately implement your new skills in real-world scenarios. Whether you’re new to PALADIN or looking to deepen your existing knowledge, this workshop offers a hands-on experience to enhance your forensic capabilities. Join us to unlock the full potential of PALADIN in your forensic investigations.

Part 1 at 12:30pm-1:30pm (Sunset 3)

Part 2 at 2:00pm-3:00pm (Sunset 3)

HTCIA 2024 conference includes topics related to Cloud forensics, Cryptocurrency investigations, qualifications of the digital forensic examiner as a witness, forensic analysis of data in an SQLite database, PowerShell of Incident Response, OSINT techniques, IOS Forensics and many more technology investigation topics.
Don’t miss this opportunity! See you there!
Need more information? Please email us at hello@sumuri.com

MFSC-101: Fairfax, VA
2024-09-09 - 2024-09-13 | Fairfax, Virginia
SOLD OUT
Best Practices in Mac Forensics will be presented by SUMURI on September 9 – September 13, 2024, in Fairfax, Virginia for the Department of Homeland Security.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
This course is open to hosting agency personnel only.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Techno Security & Digital Forensics Conference 2024 - West
2024-09-16 - 2024-09-18 | Pasadena Convention Center, 300 E Green St, Pasadena CA 91101, USA
SUMURI, an award-winning leader in digital forensics, is excited to be a Bronze Sponsor at the Techno Security & Digital Forensics Conference 2024 – West in Pasadena, California, from September 16th to 18th. Visit us at Booth #118.

Join us to explore our cutting-edge solutions firsthand and discover how SUMURI’s products can significantly enhance your investigative capabilities. Don’t miss this opportunity to connect with our experts and learn more about the latest advancements in digital forensics.

September 17th from 11:00 AM to 12:00 PM, "Mastering Live Volatile Data Collection on Mac" by Steve Whalen at Ballroom B

This workshop invites you to bring your own Mac for an immersive, practical experience.
We’ll dive into the specifics of macOS, exploring how to manually collect key forensic data like active network connections, running processes, and user session information, using the unique features and utilities inherent to macOS. This session is designed to equip you with the skills to navigate and investigate the complexities of macOS in live forensic scenarios. As the workshop unfolds, you’ll understand why Macs, with their distinct operating system and security features, are increasingly significant in digital investigations.

"Mastering Live Volatile Data Collection on Mac" by Steve Whalen at Ballroom B

This workshop invites you to bring your own Mac for an immersive, practical experience.
We’ll dive into the specifics of macOS, exploring how to manually collect key forensic data like active network connections, running processes, and user session information, using the unique features and utilities inherent to macOS. This session is designed to equip you with the skills to navigate and investigate the complexities of macOS in live forensic scenarios. As the workshop unfolds, you’ll understand why Macs, with their distinct operating system and security features, are increasingly significant in digital investigations.

Techno Security & Digital Forensics Conference has been the most important gathering of private sector and government attendees dedicated to the digital forensics and computer security industries. Techno is more than a conference, it’s where the community comes together to learn, network, and share.

Don’t miss this opportunity! See you there!

Meet the Experts:

Steve Whalen

Co-Founder, SUMURI LLC

Dan Erickson

TALINO Sales and Support Manager, SUMURI LLC

MFSC-201: Fairfax, VA
2024-09-16 - 2024-09-20 | Fairfax, Virginia
SOLD OUT
Advanced Practices in Mac Forensics will be presented by SUMURI on September 16 – September 20, 2024, in Fairfax, Virginia for the Department of Homeland Security.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
MFSC-201 covers topics such as Time Machine Analysis, iCloud Forensics, Application Deconstruction, File System Events, and Scripting and Automation. The knowledge you gain from our training can be applied to any forensic tool on any platform.
SUMURI’s Mac Forensic Survival Courses (MFSC) provide vendor-neutral training that covers the process of examining a Mac computer from the first step to the last step, in logical order. No sales pitch, just Mac Forensics!

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/

This course is open to hosting agency personnel only.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

OpenText-SUMURI Lunch and Learn
2024-09-24 10:00 - 14:00 (America/New_York) | SUMURI LLC, 40 South Main Street, Magnolia, DE, United States
In the fast-paced world of digital forensic investigations, pointing your investigation in the right direction from the outset is crucial. Effective triage can significantly accelerate your investigative process, and having the right tools at your fingertips is essential for a successful start.
Join our Lunch & Learn session to discover how EnCase Forensic empowers you to use your time wisely by previewing images during the collection process, ensuring you get started on the right foot and save valuable time. Additionally, you will experience the power of EnCase’s latest capabilities and performance enhancements, which streamline evidence processing and enhance efficiency in previewing, collecting, and analyzing digital evidence.
We will also address the increasing diversity, size, and sophistication of digital media that complicates evidence collection. Investigators need to quickly image suspect devices, improve their efficiency, and ensure forensic integrity. Learn about the new capabilities Tableau Forensic delivers, providing cost-effective, reliable, portable standalone forensic imaging of physical media for digital forensic investigations.
You’ll also have the opportunity to explore how TALINO Forensic Bridges adapt to fieldwork, allowing forensic experts to perform critical imaging and analysis of digital evidence on-site with the flexibility to operate outside traditional office settings.
This demonstration will showcase the advanced features of EnCase Forensic, Tableau Forensic, and TALINO Forensic Bridges, illustrating how these tools can optimize your investigation workflow and help you achieve faster, more efficient results.

Tools You’ll Discover:

EnCase Forensic

Experience how EnCase Forensic helps you save valuable time by previewing images during the collection process, streamlining evidence processing, and enhancing efficiency in analyzing digital evidence.

Tableau Forensic

Discover Tableau Forensic’s capabilities in providing cost-effective, reliable, and portable standalone forensic imaging, perfect for quickly imaging suspect devices while ensuring forensic integrity.

Portable T356789iu TALINO Forensic Bridges

Explore the advanced features of TALINO Forensic Bridges, designed to enhance your ability to quickly and efficiently image and analyze digital evidence in the field with SUMURI’s custom-designed enclosure.

Meet the Experts:

Speaker 1

Victor De La Peña

Senior Solutions Consultant, OpenText

Speaker 2

Jason Roslewicz

VP Business Development, SUMURI LLC

We’re excited to share valuable insights and practical demonstrations that will enhance your digital forensic investigations.

For inquiries, email us at hello@sumuri.com.

See you on September 24th!

HTCIA CANADA
2024-10-01 - 2024-10-03 | Palais des congrès de Gatineau
Join SUMURI at the 2024 Canada Cyber Investigation Summit hosted by High Technology Crime Investigation Association from October 1-3, 2024, at the Palais des congrès de Gatineau.
Our Vice President of Business Development, Jason Roslewicz, will be available to discuss how SUMURI’s forensic solutions can enhance your investigative capabilities at Booth 12.
This summit will focus on practical information, including case simulations, to help investigators succeed and grow in their careers.
Don’t miss this chance to connect! For more information, email us at hello@sumuri.com.

10th NW ICAC & Technology Conference 2024
2024-10-07 - 2024-10-11 | Microsoft Campus, 5010 NE 36th St, Building 92 Redmond, WA 98052-5317, WA
SUMURI, an award-winning leader in digital forensics, is proud to collaborate with NW ICAC to co-host the NW ICAC & Technology Conference celebrating the 10th anniversary of both TALINO and NW ICAC.
Join us as we celebrate TALINO’s enduring legacy of innovation and dedication in the fight against internet crimes against children, reflecting many years of progress and unwavering commitment.
Mastering Mac Forensics: Hands-On Workshop for Triage, Acquisition, and Analysis by Chris Grettenberger and Steve Whalen at Utopia Conference Room.
Participants need to bring a Mac computer equipped with the latest macOS version, along with a user account that has administrator privileges.
This training is designed to equip participants with practical skills in Mac triage, acquisition, and the utilization of RECON ITR and LAB software. It’s structured to provide a balance of theory, practical demonstrations, and hands-on exercises.

Topics to be covered:

Initial assessment and challenges with Macs

Performing live triage

Overview of acquisition types

Dealing with encryption and password protection

Tools and methods for acquisitions

Demonstration of RECON ITR and RECON LAB

The Washington State Internet Crimes Against Children Task Force (WA ICAC TF) is a multi-jurisdictional group of agencies dedicated to the protection of children from sexual abuse and exploitation. The WA ICAC TF is one of 61 task force groups in the national ICAC Task Force Program which is administered by the US Department of Justice/Office of Juvenile Justice and Delinquency Prevention (OJJDP).

Meet the Experts:

Speaker 1

Chris Grettenbeger

Senior Forensic Specialist, SUMURI LLC

Speaker 2

Steve Whalen

Co-Founder, SUMURI LLC

Limited slots are available! Register Now!

MFSC-101: Online, US Eastern Standard Time
2024-11-04 - 2024-11-08 | FL
Best Practices in Mac Forensics will be presented by SUMURI from November 04 – 08, 2024, 8:00 AM to 5:00 PM EST.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
This course is open for registration and will be taught in the US Eastern Standard Time Zone.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

MFSC-201: Online, US Eastern Standard Time
2024-12-09 - 2024-12-13 | FL
Advanced Practices in Mac Forensics will be presented by SUMURI from December 09 – 13, 2024, 8:00 AM to 5:00 PM EST.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
MFSC-201 covers topics such as Time Machine Analysis, iCloud Forensics, Application Deconstruction, File System Events, and Scripting and Automation. Completion of MFSC-101 (or comparable Mac Forensics course) is strongly recommended before taking MFSC-201. The knowledge you gain from our training can be applied to any forensic tool on any platform.
SUMURI’s Mac Forensic Survival Courses (MFSC) provide vendor-neutral training that covers the process of examining a Mac computer from the first step to the last step, in logical order. No sales pitch, just Mac Forensics!

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
This course is open for registration and will be taught in the US Eastern Standard Time Zone.

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

MFSC-101: Online, Hong Kong
2025-01-13 - 2025-01-17 | FL
Best Practices in Mac Forensics will be presented by SUMURI from January 13 – 17, 2025, 8:00 AM to 5:00 PM HKT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

MFSC-201: Online, Hong Kong
2025-01-20 - 2025-01-24 | FL
Advanced Practices in Mac Forensics will be presented by SUMURI from January 20 – 24 2025, 8:00 AM to 5:00 PM HKT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

MFSC-201: Online, US Eastern Standard Time
2025-03-03 - 2025-03-07 | FL
Advanced Practices in Mac Forensics will be presented by SUMURI from March 3 – 7 2025, 8:00 AM to 5:00 PM EST.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 OpenText-SUMURI Lunch and Learn
2025-03-10 09:00 - 12:00 | OpenText Gaithersburg Training Center, OpenText Gaithersburg Training Center 9711 Washingtonian Boulevard Gaithersburg, MD 20878
In the fast-paced world of digital forensic investigations, pointing your investigation in the right direction from the outset is crucial. Effective triage can significantly accelerate your investigative process, and having the right tools at your fingertips is essential for a successful start.
Join our Lunch & Learn session to discover how EnCase Forensic empowers you to use your time wisely by previewing images during the collection process, ensuring you get started on the right foot and save valuable time. Additionally, you will experience the power of EnCase’s latest capabilities and performance enhancements, which streamline evidence processing and enhance efficiency in previewing, collecting, and analyzing digital evidence.
We will also address the increasing diversity, size, and sophistication of digital media that complicates evidence collection. Investigators need to quickly image suspect devices, improve their efficiency, and ensure forensic integrity. Learn about the new capabilities Tableau Forensic delivers, providing cost-effective, reliable, portable standalone forensic imaging of physical media for digital forensic investigations.
You’ll also have the opportunity to explore how TALINO Forensic Bridge adapt to fieldwork, allowing forensic experts to perform critical imaging and analysis of digital evidence on-site with the flexibility to operate outside traditional office settings.
This demonstration will showcase the advanced features of EnCase Forensic, Tableau Forensic, and TALINO Forensic Bridge, illustrating how these tools can optimize your investigation workflow and help you achieve faster, more efficient results.

Tools You’ll Discover:

EnCase Forensic

Experience how EnCase Forensic helps you save valuable time by previewing images during the collection process, streamlining evidence processing, and enhancing efficiency in analyzing digital evidence.

Tableau Forensic

Discover Tableau Forensic’s capabilities in providing cost-effective, reliable, and portable standalone forensic imaging, perfect for quickly imaging suspect devices while ensuring forensic integrity.

Portable T356789iu TALINO Forensic Bridge

Explore the advanced features of TALINO Forensic Bridge, designed to enhance your ability to quickly and efficiently image and analyze digital evidence in the field with SUMURI’s custom-designed enclosure.

Meet the Experts:

Speaker 1

Victor De La Peña

Senior Solutions Consultant, OpenText

Speaker 2

Jason Roslewicz

VP Business Development, SUMURI LLC

We’re excited to share valuable insights and practical demonstrations that will enhance your digital forensic investigations.

For inquiries, email us at hello@sumuri.com.

See you on March 10th!

MFSC-101: Orlando, Florida
2025-04-28 - 2025-05-02 | FL
Best Practices in Mac Forensics will be presented by SUMURI from April 28 – May 2, 2025, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME).
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 National Cyber Crime Conference
2025-04-29 - 2025-05-01 | Four Points by Sheraton Norwood, 1125 Boston-Providence Turnpike, Norwood, MA
Celebrate the 15th Anniversary of SUMURI at NCCC 2025
Join SUMURI at the 2025 National Cyber Crime Conference!
We’re excited to announce that SUMURI will be participating in the 14th Annual National Cyber Crime Conference (NCCC) from April 29 to May 1, 2025, at the Four Points by Sheraton Norwood, MA.
As one of the premier training events for law enforcement, prosecutors, and forensic examiners worldwide, the NCCC offers unparalleled opportunities to learn about the latest trends, tools, and techniques in digital evidence and cybercrime investigation.

What to Expect:

Expert-led sessions on emerging cybercrime topics

Hands-on training in forensic solutions

Networking with industry leaders and innovators

Visit our booth to see how SUMURI continues to revolutionize forensic solutions with cutting-edge tools and technologies designed to support your mission.

Event Details:

Dates: April 29 – May 1, 2025

Time: 7:30 AM to 5:00 PM EST

Location: Four Points by Sheraton Norwood, MA

We can’t wait to meet you and showcase our solutions built to empower your forensic investigations. See you at NCCC 2025!

2025 IACIS Digital Forensics Conference
2025-05-01 - 2025-05-05 | Caribe Royale Hotel, 8101 World Center Drive, Orlando , FL
Join SUMURI at the 2025 IACIS Digital Forensics Conference!
SUMURI is thrilled to be part of the IACIS (International Association of Computer Investigative Specialists) Digital Forensics Conference — a key event bringing together professionals in the digital forensics field from around the world.
The IACIS conference is a vital gathering for those in law enforcement, cybersecurity, and digital forensics, offering cutting-edge training, collaboration, and the latest industry insights. This conference plays a crucial role in shaping the future of digital forensics through education, research, and industry partnerships.

Event Details:

Dates: May 1, 2 & 5, 2025

Time: 9:00 AM to 5:00 PM EDT

Location: Caribe Royale Orlando, Florida

What to Expect:

In-depth training and workshops led by industry experts

Networking with top digital forensics specialists

Hands-on demonstrations of innovative forensic tools and technologies

Visit SUMURI at our booth to discover the latest in digital forensics solutions designed to enhance your investigative capabilities.

We’re looking forward to seeing you at the IACIS 2025 conference, where we’ll continue to innovate and push the boundaries of digital forensics together!

MFSC-201: Orlando, Florida
2025-05-05 - 2025-05-09 | FL
Advanced Practices in Mac Forensics will be presented by SUMURI from May 5 – May 9, 2025.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

2025 Techno Security & Digital Forensics Conference
2025-06-03 - 2025-06-05 | Wilmington Convention Center, 10 Convention Center Dr, Wilmington, NC 28401, USA, Wilmington, NC, United States
Join SUMURI at the Techno Security & Digital Forensics Conference 2025!
SUMURI is excited to participate in the Techno Security & Digital Forensics Conference, one of the most influential events in the cybersecurity and digital forensics industries.
This conference brings together top professionals from corporate network security, federal, state, and local law enforcement, as well as cybersecurity industry leaders. It aims to raise global awareness on the latest developments, training, responsibilities, and ethical practices in cybersecurity, digital forensics, and eDiscovery.

Event Details:

Dates: June 3 – June 5, 2025

Location: Wilmington Convention Center

Time: 8:00 AM to 5:00 PM EDT

What to Expect:

Expert-led discussions and training sessions

Networking with leaders in digital forensics and cybersecurity

Access to innovative tools and technologies for forensic investigations

Visit SUMURI at our booth to explore the latest solutions designed to streamline your digital forensics workflow.

We look forward to seeing you at Techno Security 2025 and advancing the future of cybersecurity and digital forensics together!

MFSC-101: Online, Eastern Daylight Time
2025-09-08 - 2025-09-12 | FL
Best Practices in Mac Forensics will be presented by SUMURI from September 08 – 12, 2025, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 Delaware NIGP Area II Conference
2025-09-25 | Bally’s Hotel & Conference Center, Dover, DE, Bally’s Hotel & Conference Center, Dover, DE
Join SUMURI at the 2025 Delaware NIGP Area II Conference!
Are you ready to discover solutions that not only meet your agency’s needs but also empower your community? SUMURI is heading to the NIGP Area II Conference & Vendor Expo, and we want to connect with you!
This isn’t just another conference; it’s your chance to get ahead of the curve and see the tools that are shaping the future of public procurement.

Event Details:
Where: Bally’s Hotel & Conference Center, Dover, DE
When: September 25, 2025
See more details

Your Exclusive Booth Experience
Stop by our Booth for more than just a brochure. We’re offering an interactive experience designed for you:

Live Demos:
Witness our cutting-edge tools in action! We’ll showcase how SUMURI’s solutions can streamline your workflow and enhance your agency’s capabilities.
Expert Consultations: Have a unique challenge? Our team will be on hand to offer personalized advice and discuss strategies tailored to your specific goals.

Why Make SUMURI Your First Stop?

Solve, Don’t Settle: Discover innovative solutions designed to tackle the real-world challenges you face in public procurement.
Connect with the Experts: Go beyond a sales pitch. Meet the team behind the technology and build a partnership that supports your mission.
Lead the Way: Network with fellow leaders and position your agency at the forefront of efficiency and public safety.

We look forward to seeing you there!
Save the date, mark our booth on your map, and get ready to be inspired. Stop by anytime—we can’t wait to connect with you in Dover!

NW ICAC & Technology Conference 2025
2025-10-06 - 2025-10-09 | Microsoft Campus, 5010 NE 36th St, Building 92 Redmond, WA 98052-5317, WA
A Legacy of Innovation in Digital Forensics
Join SUMURI, as we celebrate our 15th Anniversary at the NW ICAC & Technology Conference 2025. For 15 years, SUMURI has been committed to delivering intuitive, ethical, and powerful forensic solutions that empower professionals in their mission to protect and investigate.
Why Visit SUMURI at NW ICAC?

Explore Industry-Leading Software
Get hands-on with our full suite of digital forensic tools, including RECON LAB, RECON ITR, and PALADIN.
Experience TALINO® Workstations
See how our high-performance forensic systems are purpose-built for speed, reliability, and precision.
Support ICAC Investigations
Discover how our solutions are designed to assist in sensitive investigations, including internet crimes against children.
Meet the Experts
Connect with our team of seasoned forensic professionals and thought leaders driving innovation in the field.
Celebrate a Shared Mission
Join us in recognizing the collective efforts of professionals dedicated to justice, protection, and truth.

Event Information
Event: NW ICAC & Technology Conference 2025
Dates: October 6–9, 2025
Location: Microsoft Visitor Center, Redmond, WA
Booth: 14

SUMURI Talks You Don’t Want to Miss

Mastering Live Volatile Data Collection on Macs: What Suspects Hope You Miss
Steve Whalen, CFCE, CFME, Co-Founder of SUMURI
October 9, 2025 | 2:00 PM – 3:30 PM (PDT)
Add to Your Agenda

PALADIN LTS Reforged: Fast, Free, and Field-Ready Forensics
Steve Whalen, CFCE, CFME, Co-Founder of SUMURI
October 9, 2025 | 3:45 PM – 5:15 PM (PDT)
Add to Your Agenda

2025 NW Regional ICAC Conference
Hosted by the ICAC Task Force Program — a national network of 4,500+ agencies combating tech-enabled crimes against children.

New Venue: Hilton Garden Inn, Downtown Redmond
Raffle Prizes: Donated by Microsoft, Seattle PD & sponsors

Register Now

Looking Ahead
As we look to the future, SUMURI remains committed to building fast, user-friendly, and globally trusted forensic solutions. Whether you’re in the lab, out in the field, or training the next generation of investigators — we’re here to support your mission.
Let’s Connect
Want to schedule a meeting or have questions before the event?
Reach out — we’d love to connect.
Visit: https://sumuri.com
Email: hello@sumuri.com
