2026 IACIS Digital Forensics Conference
2026-04-30 - 2026-05-04 | Caribe Royale Hotel, 8101 World Center Drive, Orlando , FL
Join SUMURI at the 2026 IACIS Digital Forensics Conference!
SUMURI is thrilled to be part of the IACIS (International Association of Computer Investigative Specialists) Digital Forensics Conference — a key event bringing together professionals in the digital forensics field from around the world.
The IACIS conference is a vital gathering for those in law enforcement, cybersecurity, and digital forensics, offering cutting-edge training, collaboration, and the latest industry insights. This conference plays a crucial role in shaping the future of digital forensics through education, research, and industry partnerships.

Event Details:
Dates: April 30, May 1 & May 4th
Location: Caribe Royale Orlando
Time: 8:00 AM to 5:00 PM EDT
Booth Staff: Steve & Jason
Booth #: TBA
What to Expect:

In-depth training and workshops led by industry experts
Networking with top digital forensics specialists
Hands-on demonstrations of innovative forensic tools and technologies

Visit SUMURI at our booth to discover the latest in digital forensics solutions designed to enhance your investigative capabilities.
We’re looking forward to seeing you at the IACIS 2026 conference, where we’ll continue to innovate and push the boundaries of digital forensics together!

MFSC-201: Orlando, Florida
2026-05-04 - 2026-05-08
Advanced Practices in Mac Forensics will be presented by SUMURI from May 4 – May 8, 2026, 8:00 AM to 5:00 PM EDT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Prerequisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

MFSC-101: Online, Central European Standard Time
2026-05-18 - 2026-05-22
Best Practices in Mac Forensics will be presented by SUMURI from May 18 – 22, 2026, 8:00 AM to 5:00 PM CEST.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology:

Students will gain a foundational understanding of macOS file systems, focusing on the key differences between APFS and HFS+ and how they compare to non-Mac formats like exFAT and NTFS. The module covers challenges unique to analyzing each format, including how macOS handles volume management with technologies like synthesized disks, Core Storage, and Fusion Drives. This knowledge is essential for interpreting file structures and ensuring accurate evidence collection and analysis.

Understanding the Mac File System Technology:

Learn the differences between APFS, HFS+, and other formats, along with challenges in analyzing each and related technologies like synthesized disks, Core Storage, and Fusion Drives.

Intel Mac Technology and Bootcamp:

Understand Intel-based Mac architecture, its differences from Apple Silicon, and forensic considerations for Secure Enclave, Secure Boot, Bootcamp, and virtualization.

Silicon Mac Technology:

Examine Apple Silicon architecture, security features, imaging challenges, and how to properly seize and analyze these newer devices.

Mac Security:

Explore macOS security layers including Secure Enclave, Secure Boot, FileVault, and user permissions, plus examiner techniques for working within these constraints.

Macintosh Search and Seizure:

Learn seizure procedures to protect against risks like remote wipe, user traps, and evidence loss, with a step-by-step on-scene process.

Safely Obtaining System Information:

Identify system details such as macOS version, hardware type, and security settings to guide acquisition decisions for live and powered-down Macs.

Volatile Data Collection:

Understand challenges in modern RAM capture and learn alternative methods for collecting valuable live-response data before it is lost.

Forensic Imaging:

Gain hands-on experience performing logical and physical imaging, selecting source disks, and using free tools to acquire data securely.

Mounting Forensic Images in macOS:

Safely mount images to preserve evidence while enabling access to indexed data and macOS-native search tools.

Indexing and Searching Forensic Images in macOS:

Use macOS indexing and search from both GUI and command line to locate evidence quickly and efficiently.

Manual Artifact Deconstruction of First-Party Applications:

Learn to locate, analyze, and extract data from Apple’s native apps, building skills for unsupported or unfamiliar artifacts.

Recovering Deleted Files on macOS:

Test recovery methods while understanding the impact of APFS, TRIM, encryption, and hardware limitations on file recovery.

Examining SQLite Databases and PLIST Files:

Locate and analyze these key artifacts with proper tools, SQL queries, and PLIST conversion techniques.

Report Development:

Create high-quality, native-format reports using macOS tools to present artifacts accurately and clearly.

Secure Your Spot – Limited Seats Available!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended.

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

2026 Techno Security & Digital Forensics Conference East
2026-06-02 - 2026-06-04 | Marriott Myrtle Beach Resort, 8400 Costa Verde Drive, Myrtle Beach, 29572, United States
Join SUMURI at the Techno Security & Digital Forensics Conference 2026!
SUMURI is excited to participate in the Techno Security & Digital Forensics Conference East, one of the most influential events in the cybersecurity and digital forensics industries.
This conference brings together top professionals from corporate network security, federal, state, and local law enforcement, as well as cybersecurity industry leaders. It aims to raise global awareness on the latest developments, training, responsibilities, and ethical practices in cybersecurity, digital forensics, and eDiscovery.

Event Details:
Dates: June 2 – 4, 2026
Location: Myrtle Beach Sheraton and Convention Center
Time: 8:00 AM to 5:00 PM EDT
Booth Staff: Jason, Dakota and Justin H
Booth #: 314
What to Expect:

Expert-led discussions and training sessions
Networking with leaders in digital forensics and cybersecurity
Access to innovative tools and technologies for forensic investigations

Visit SUMURI at our booth to explore the latest solutions designed to streamline your digital forensics workflow.
We look forward to seeing you at Techno Security 2026 and advancing the future of cybersecurity and digital forensics together!

MFSC-101: Online, Eastern Daylight Time
2026-07-20 - 2026-07-24
Best Practices in Mac Forensics will be presented by SUMURI from July 20 – 24, 2026, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology:

Students will gain a foundational understanding of macOS file systems, focusing on the key differences between APFS and HFS+ and how they compare to non-Mac formats like exFAT and NTFS. The module covers challenges unique to analyzing each format, including how macOS handles volume management with technologies like synthesized disks, Core Storage, and Fusion Drives. This knowledge is essential for interpreting file structures and ensuring accurate evidence collection and analysis.

Understanding the Mac File System Technology:

Learn the differences between APFS, HFS+, and other formats, along with challenges in analyzing each and related technologies like synthesized disks, Core Storage, and Fusion Drives.

Intel Mac Technology and Bootcamp:

Understand Intel-based Mac architecture, its differences from Apple Silicon, and forensic considerations for Secure Enclave, Secure Boot, Bootcamp, and virtualization.

Silicon Mac Technology:

Examine Apple Silicon architecture, security features, imaging challenges, and how to properly seize and analyze these newer devices.

Mac Security:

Explore macOS security layers including Secure Enclave, Secure Boot, FileVault, and user permissions, plus examiner techniques for working within these constraints.

Macintosh Search and Seizure:

Learn seizure procedures to protect against risks like remote wipe, user traps, and evidence loss, with a step-by-step on-scene process.

Safely Obtaining System Information:

Identify system details such as macOS version, hardware type, and security settings to guide acquisition decisions for live and powered-down Macs.

Volatile Data Collection:

Understand challenges in modern RAM capture and learn alternative methods for collecting valuable live-response data before it is lost.

Forensic Imaging:

Gain hands-on experience performing logical and physical imaging, selecting source disks, and using free tools to acquire data securely.

Mounting Forensic Images in macOS:

Safely mount images to preserve evidence while enabling access to indexed data and macOS-native search tools.

Indexing and Searching Forensic Images in macOS:

Use macOS indexing and search from both GUI and command line to locate evidence quickly and efficiently.

Manual Artifact Deconstruction of First-Party Applications:

Learn to locate, analyze, and extract data from Apple’s native apps, building skills for unsupported or unfamiliar artifacts.

Recovering Deleted Files on macOS:

Test recovery methods while understanding the impact of APFS, TRIM, encryption, and hardware limitations on file recovery.

Examining SQLite Databases and PLIST Files:

Locate and analyze these key artifacts with proper tools, SQL queries, and PLIST conversion techniques.

Report Development:

Create high-quality, native-format reports using macOS tools to present artifacts accurately and clearly.

Secure Your Spot – Limited Seats Available!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended.

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

NATIA 2026: Annual Training Conference & Technology Exhibition
2026-07-27 - 2026-07-30 | Greater Columbus Convention Center, 400 N High St, Columbus, OH 43215, United States
Join SUMURI at the 2026 National Technical Investigators’ Association Conference!
SUMURI is thrilled to be part of the National Technical Investigators’ Association Conference — a key event bringing together professionals in the digital forensics field from around the world.
The National Technical Investigators’ Association is composed of over 3,500 law enforcement, intelligence, and support personnel who provide electronic surveillance, technical operations, and scientific support for hundreds of federal, military, state, and local agencies across the United States and around the world.

Event Details:
Dates: July 27 – 30, 2026
Location: Greater Columbus Convention Center
Time: 8:00 AM to 5:00 PM EDT
Booth Staff: Jason and Steve
Booth #: 763
What to Expect:

In-depth training and workshops led by industry experts
Networking with top digital forensics specialists
Hands-on demonstrations of innovative forensic tools and technologies

Visit SUMURI at our booth to discover the latest in digital forensics solutions designed to enhance your investigative capabilities.
We’re looking forward to seeing you at the NATIA 2026 conference, where we’ll continue to innovate and push the boundaries of digital forensics together!

MFSC-201: Online, Eastern Daylight Time
2026-08-31 - 2026-09-04
Advanced Practices in Mac Forensics will be presented by SUMURI from August 31 – September 4, 2026, 8:00 AM to 5:00 PM EDT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Item #2

Topics to include but are not limited to:

Advanced macOS Artifact Analysis

Deep dive into property lists, SQLite databases, bundle files, and library directories to uncover key forensic evidence.

Advanced macOS Artifact Analysis:

Deep dive into property lists, SQLite databases, bundle files, and library directories to uncover key forensic evidence.

User and System Activity Reconstruction:

Identify user account changes, network connections, attached devices, and hibernation states to build detailed timelines.

Mastering macOS Timestamps:

Learn how to interpret POSIX and Apple Extended Attribute timestamps to track file and system events accurately.

Comprehensive Log Analysis:

Extract and interpret data from unified logs, domain-specific logs, and application logs to reveal user actions and system events.

Application Deconstruction:

Perform static and dynamic artifact analysis of first- and third-party applications to uncover hidden or unsupported evidence.

Advanced Command Line for Forensics:

Utilize macOS terminal commands to locate, extract, and analyze artifacts quickly and efficiently.

Time Machine and FSEvents Forensics:

Recover historical snapshots, identify file changes, and track system activity over time.

RAM, Virtual Machine, and iOS Artifact Analysis:

Examine volatile memory, virtual machine images, and iOS data stored on Macs.

Custom Forensic Tool Development:

Learn to script your own acquisition, triage, and data collection tools in Bash and Python.

macOS Automation for Investigations:

Leverage AppleScript and Automator to streamline repetitive forensic tasks.

Secure Your Spot – Limited Seats Available!

2026 NW ICAC & Technology Conference
2026-09-21 - 2026-09-24 | Hyatt Regency Bellevue, 900 Bellevue Way NE, Bellevue, WA 98004, United States
Join SUMURI at the NW ICAC & Technology Conference 2026!
SUMURI is proud to participate in the NW ICAC & Technology Conference, a premier event focused on combating crimes committed online against children. This important conference brings together law enforcement professionals, investigators, prosecutors, and technology experts dedicated to protecting children and holding offenders accountable.
The conference provides a platform to share knowledge, training, and tools that strengthen the ability of professionals to investigate internet crimes against children and support victims. Attendees will gain valuable insights through expert-led sessions, networking opportunities, and technology demonstrations throughout the week.

Event Details:
Dates: September 21 – 24, 2026
Location: Hyatt Regency Bellevue
Address: 900 Bellevue Way NE, Bellevue, WA 98004, United States
Booth Staff: Jason and Dakota
Booth #: TBA
Why Visit SUMURI at NW ICAC?

Explore Industry-Leading Software
Get hands-on with our powerful digital forensic tools, including RECON LAB, RECON ITR, and PALADIN.
Experience TALINO® Workstations
Discover how our high-performance forensic systems are purpose-built for speed, reliability, and precision in digital investigations.
Support ICAC Investigations
Learn how our solutions are designed to assist investigators working on sensitive cases, including internet crimes against children.
Meet the Experts
Connect with our team of forensic professionals and technology experts who are driving innovation in digital forensics.
Celebrate a Shared Mission
Join professionals from across the industry who are committed to protecting children, delivering justice, and advancing investigative capabilities.

Throughout the week, attendees can explore sessions, exhibitors, sponsors, confirmed speakers, and networking events designed to strengthen collaboration and knowledge sharing within the ICAC community.
Visit SUMURI during the conference to see our latest digital forensic solutions and learn how we support investigators working on critical cases around the world.
We look forward to seeing you at the NW ICAC & Technology Conference 2026!
