SUMURI

MFSC-201: Online, US Eastern Standard Time
2025-03-03 - 2025-03-07
Advanced Practices in Mac Forensics will be presented by SUMURI from March 3 – 7 2025, 8:00 AM to 5:00 PM EST.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 OpenText-SUMURI Lunch and Learn
2025-03-10 09:00 - 12:00 (America/New_York) | OpenText Gaithersburg Training Center, OpenText Gaithersburg Training Center 9711 Washingtonian Boulevard Gaithersburg, MD 20878
In the fast-paced world of digital forensic investigations, pointing your investigation in the right direction from the outset is crucial. Effective triage can significantly accelerate your investigative process, and having the right tools at your fingertips is essential for a successful start.
Join our Lunch & Learn session to discover how EnCase Forensic empowers you to use your time wisely by previewing images during the collection process, ensuring you get started on the right foot and save valuable time. Additionally, you will experience the power of EnCase’s latest capabilities and performance enhancements, which streamline evidence processing and enhance efficiency in previewing, collecting, and analyzing digital evidence.
We will also address the increasing diversity, size, and sophistication of digital media that complicates evidence collection. Investigators need to quickly image suspect devices, improve their efficiency, and ensure forensic integrity. Learn about the new capabilities Tableau Forensic delivers, providing cost-effective, reliable, portable standalone forensic imaging of physical media for digital forensic investigations.
You’ll also have the opportunity to explore how TALINO Forensic Bridge adapt to fieldwork, allowing forensic experts to perform critical imaging and analysis of digital evidence on-site with the flexibility to operate outside traditional office settings.
This demonstration will showcase the advanced features of EnCase Forensic, Tableau Forensic, and TALINO Forensic Bridge, illustrating how these tools can optimize your investigation workflow and help you achieve faster, more efficient results.

Tools You’ll Discover:

EnCase Forensic

Experience how EnCase Forensic helps you save valuable time by previewing images during the collection process, streamlining evidence processing, and enhancing efficiency in analyzing digital evidence.

Tableau Forensic

Discover Tableau Forensic’s capabilities in providing cost-effective, reliable, and portable standalone forensic imaging, perfect for quickly imaging suspect devices while ensuring forensic integrity.

Portable T356789iu TALINO Forensic Bridge

Explore the advanced features of TALINO Forensic Bridge, designed to enhance your ability to quickly and efficiently image and analyze digital evidence in the field with SUMURI’s custom-designed enclosure.

Meet the Experts:

Speaker 1

Victor De La Peña

Senior Solutions Consultant, OpenText

Speaker 2

Jason Roslewicz

VP Business Development, SUMURI LLC

We’re excited to share valuable insights and practical demonstrations that will enhance your digital forensic investigations.

For inquiries, email us at hello@sumuri.com.

See you on March 10th!

MFSC-101: Orlando, Florida
2025-04-28 - 2025-05-02
Best Practices in Mac Forensics will be presented by SUMURI from April 28 – May 2, 2025, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME).
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 National Cyber Crime Conference
2025-04-29 - 2025-05-01 | Four Points by Sheraton Norwood, 1125 Boston-Providence Turnpike, Norwood, MA
Celebrate the 15th Anniversary of SUMURI at NCCC 2025
Join SUMURI at the 2025 National Cyber Crime Conference!
We’re excited to announce that SUMURI will be participating in the 14th Annual National Cyber Crime Conference (NCCC) from April 29 to May 1, 2025, at the Four Points by Sheraton Norwood, MA.
As one of the premier training events for law enforcement, prosecutors, and forensic examiners worldwide, the NCCC offers unparalleled opportunities to learn about the latest trends, tools, and techniques in digital evidence and cybercrime investigation.

What to Expect:

Expert-led sessions on emerging cybercrime topics

Hands-on training in forensic solutions

Networking with industry leaders and innovators

Visit our booth to see how SUMURI continues to revolutionize forensic solutions with cutting-edge tools and technologies designed to support your mission.

Event Details:

Dates: April 29 – May 1, 2025

Time: 7:30 AM to 5:00 PM EST

Location: Four Points by Sheraton Norwood, MA

We can’t wait to meet you and showcase our solutions built to empower your forensic investigations. See you at NCCC 2025!

2025 IACIS Digital Forensics Conference
2025-05-01 - 2025-05-05 | Caribe Royale Hotel, 8101 World Center Drive, Orlando , FL
Join SUMURI at the 2025 IACIS Digital Forensics Conference!
SUMURI is thrilled to be part of the IACIS (International Association of Computer Investigative Specialists) Digital Forensics Conference — a key event bringing together professionals in the digital forensics field from around the world.
The IACIS conference is a vital gathering for those in law enforcement, cybersecurity, and digital forensics, offering cutting-edge training, collaboration, and the latest industry insights. This conference plays a crucial role in shaping the future of digital forensics through education, research, and industry partnerships.

Event Details:

Dates: May 1, 2 & 5, 2025

Time: 9:00 AM to 5:00 PM EDT

Location: Caribe Royale Orlando, Florida

What to Expect:

In-depth training and workshops led by industry experts

Networking with top digital forensics specialists

Hands-on demonstrations of innovative forensic tools and technologies

Visit SUMURI at our booth to discover the latest in digital forensics solutions designed to enhance your investigative capabilities.

We’re looking forward to seeing you at the IACIS 2025 conference, where we’ll continue to innovate and push the boundaries of digital forensics together!

MFSC-201: Orlando, Florida
2025-05-05 - 2025-05-09
Advanced Practices in Mac Forensics will be presented by SUMURI from May 5 – May 9, 2025.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

2025 Techno Security & Digital Forensics Conference
2025-06-03 - 2025-06-05 | Wilmington Convention Center, 10 Convention Center Dr, Wilmington, NC 28401, USA, Wilmington, NC, United States
Join SUMURI at the Techno Security & Digital Forensics Conference 2025!
SUMURI is excited to participate in the Techno Security & Digital Forensics Conference, one of the most influential events in the cybersecurity and digital forensics industries.
This conference brings together top professionals from corporate network security, federal, state, and local law enforcement, as well as cybersecurity industry leaders. It aims to raise global awareness on the latest developments, training, responsibilities, and ethical practices in cybersecurity, digital forensics, and eDiscovery.

Event Details:

Dates: June 3 – June 5, 2025

Location: Wilmington Convention Center

Time: 8:00 AM to 5:00 PM EDT

What to Expect:

Expert-led discussions and training sessions

Networking with leaders in digital forensics and cybersecurity

Access to innovative tools and technologies for forensic investigations

Visit SUMURI at our booth to explore the latest solutions designed to streamline your digital forensics workflow.

We look forward to seeing you at Techno Security 2025 and advancing the future of cybersecurity and digital forensics together!

MFSC-101: Online, Eastern Daylight Time
2025-09-08 - 2025-09-12
Best Practices in Mac Forensics will be presented by SUMURI from September 08 – 12, 2025, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

2025 Delaware NIGP Area II Conference
2025-09-25 | Bally’s Hotel & Conference Center, Dover, DE, Bally’s Hotel & Conference Center, Dover, DE
Join SUMURI at the 2025 Delaware NIGP Area II Conference!
Are you ready to discover solutions that not only meet your agency’s needs but also empower your community? SUMURI is heading to the NIGP Area II Conference & Vendor Expo, and we want to connect with you!
This isn’t just another conference; it’s your chance to get ahead of the curve and see the tools that are shaping the future of public procurement.

Event Details:
Where: Bally’s Hotel & Conference Center, Dover, DE
When: September 25, 2025
See more details

Your Exclusive Booth Experience
Stop by our Booth for more than just a brochure. We’re offering an interactive experience designed for you:

Live Demos:
Witness our cutting-edge tools in action! We’ll showcase how SUMURI’s solutions can streamline your workflow and enhance your agency’s capabilities.
Expert Consultations: Have a unique challenge? Our team will be on hand to offer personalized advice and discuss strategies tailored to your specific goals.

Why Make SUMURI Your First Stop?

Solve, Don’t Settle: Discover innovative solutions designed to tackle the real-world challenges you face in public procurement.
Connect with the Experts: Go beyond a sales pitch. Meet the team behind the technology and build a partnership that supports your mission.
Lead the Way: Network with fellow leaders and position your agency at the forefront of efficiency and public safety.

We look forward to seeing you there!
Save the date, mark our booth on your map, and get ready to be inspired. Stop by anytime—we can’t wait to connect with you in Dover!

NW ICAC & Technology Conference 2025
2025-10-06 - 2025-10-09 | Microsoft Campus, 5010 NE 36th St, Building 92 Redmond, WA 98052-5317, WA
A Legacy of Innovation in Digital Forensics
Join SUMURI, as we celebrate our 15th Anniversary at the NW ICAC & Technology Conference 2025. For 15 years, SUMURI has been committed to delivering intuitive, ethical, and powerful forensic solutions that empower professionals in their mission to protect and investigate.
Why Visit SUMURI at NW ICAC?

Explore Industry-Leading Software
Get hands-on with our full suite of digital forensic tools, including RECON LAB, RECON ITR, and PALADIN.
Experience TALINO® Workstations
See how our high-performance forensic systems are purpose-built for speed, reliability, and precision.
Support ICAC Investigations
Discover how our solutions are designed to assist in sensitive investigations, including internet crimes against children.
Meet the Experts
Connect with our team of seasoned forensic professionals and thought leaders driving innovation in the field.
Celebrate a Shared Mission
Join us in recognizing the collective efforts of professionals dedicated to justice, protection, and truth.

Event Information
Event: NW ICAC & Technology Conference 2025
Dates: October 6–9, 2025
Location: Microsoft Visitor Center, Redmond, WA
Booth: 14

SUMURI Talks You Don’t Want to Miss

Mastering Live Volatile Data Collection on Macs: What Suspects Hope You Miss
Steve Whalen, CFCE, CFME, Co-Founder of SUMURI
October 9, 2025 | 2:00 PM – 3:30 PM (PDT)
Add to Your Agenda

PALADIN LTS Reforged: Fast, Free, and Field-Ready Forensics
Steve Whalen, CFCE, CFME, Co-Founder of SUMURI
October 9, 2025 | 3:45 PM – 5:15 PM (PDT)
Add to Your Agenda

2025 NW Regional ICAC Conference
Hosted by the ICAC Task Force Program — a national network of 4,500+ agencies combating tech-enabled crimes against children.

New Venue: Hilton Garden Inn, Downtown Redmond
Raffle Prizes: Donated by Microsoft, Seattle PD & sponsors

Register Now

Looking Ahead
As we look to the future, SUMURI remains committed to building fast, user-friendly, and globally trusted forensic solutions. Whether you’re in the lab, out in the field, or training the next generation of investigators — we’re here to support your mission.
Let’s Connect
Want to schedule a meeting or have questions before the event?
Reach out — we’d love to connect.
Visit: https://sumuri.com
Email: hello@sumuri.com

MFSC-201: Online, Eastern Daylight Time
2025-10-20 - 2025-10-24
Advanced Practices in Mac Forensics will be presented by SUMURI from October 20 – 24 2025, 8:00 AM to 5:00 PM EDT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

MFSC-101: Singapore
2025-11-03 - 2025-11-07
Best Practices in Mac Forensics will be hosted in person in Singapore from November 03 – 07, 2025, 8:00 AM to 5:00 PM SGT, by SUMURI in partnership with Data Expert Singapore.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Need to Hide

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

Inquire About the Course

Join SUMURI at ISS World North America 2025
2025-11-04 - 2025-11-06 | Sheraton Atlanta Hotel, 165 Cortland Street, NE , Atlanta, GA, 30303, United States
We’re Bringing Real Tools to Real Investigators
This November, SUMURI will be in Washington, D.C. for ISS World North America—an event that brings together the people doing the hard work: law enforcement, intelligence, and cybersecurity professionals facing today’s most complex digital investigations.
We’re not just showing up with marketing. We’re showing up with solutions.
Featured Session with Steve Whalen

Title: TALINO + PALADIN: The Gold Standard in Custom Forensic Workstations

Date: Wednesday, November 5

Time: 4:15 — 5:00 PM

Steve Whalen

Co-Founder, SUMURI LLC

Steve will break down what makes the TALINO line the go-to forensic workstation for professionals across agencies. You’ll see what it looks like to get real performance in real casework—and how PALADIN helps simplify triage, imaging, and analysis in the field.

If you’re tired of tools that promise too much and deliver too little, this is a session you’ll want to sit in on.

Stop by Our Booth
Whether you’re just learning about SUMURI or already use our tools, come by and say hello. Our team will be there to:

Walk you through TALINO and PALADIN
Answer your technical questions
Talk shop about actual workflows and challenges in the field

Why We’re Coming
For us, it’s not about showing off—it’s about showing up. With tools that are built by former examiners, tested in the field, and made to make your job easier, faster, and more accurate.
If your job is to find the truth in digital evidence, we’re here to help. See you in D.C.

MFSC-101: Online, Eastern Standard Time
2026-02-09 - 2026-02-13
Best Practices in Mac Forensics will be presented by SUMURI from February 09 – 13, 2026, 8:00 AM to 5:00 PM EST.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology:

Students will gain a foundational understanding of macOS file systems, focusing on the key differences between APFS and HFS+ and how they compare to non-Mac formats like exFAT and NTFS. The module covers challenges unique to analyzing each format, including how macOS handles volume management with technologies like synthesized disks, Core Storage, and Fusion Drives. This knowledge is essential for interpreting file structures and ensuring accurate evidence collection and analysis.

Understanding the Mac File System Technology:

Learn the differences between APFS, HFS+, and other formats, along with challenges in analyzing each and related technologies like synthesized disks, Core Storage, and Fusion Drives.

Intel Mac Technology and Bootcamp:

Understand Intel-based Mac architecture, its differences from Apple Silicon, and forensic considerations for Secure Enclave, Secure Boot, Bootcamp, and virtualization.

Silicon Mac Technology:

Examine Apple Silicon architecture, security features, imaging challenges, and how to properly seize and analyze these newer devices.

Mac Security:

Explore macOS security layers including Secure Enclave, Secure Boot, FileVault, and user permissions, plus examiner techniques for working within these constraints.

Macintosh Search and Seizure:

Learn seizure procedures to protect against risks like remote wipe, user traps, and evidence loss, with a step-by-step on-scene process.

Safely Obtaining System Information:

Identify system details such as macOS version, hardware type, and security settings to guide acquisition decisions for live and powered-down Macs.

Volatile Data Collection:

Understand challenges in modern RAM capture and learn alternative methods for collecting valuable live-response data before it is lost.

Forensic Imaging:

Gain hands-on experience performing logical and physical imaging, selecting source disks, and using free tools to acquire data securely.

Mounting Forensic Images in macOS:

Safely mount images to preserve evidence while enabling access to indexed data and macOS-native search tools.

Indexing and Searching Forensic Images in macOS:

Use macOS indexing and search from both GUI and command line to locate evidence quickly and efficiently.

Manual Artifact Deconstruction of First-Party Applications:

Learn to locate, analyze, and extract data from Apple’s native apps, building skills for unsupported or unfamiliar artifacts.

Recovering Deleted Files on macOS:

Test recovery methods while understanding the impact of APFS, TRIM, encryption, and hardware limitations on file recovery.

Examining SQLite Databases and PLIST Files:

Locate and analyze these key artifacts with proper tools, SQL queries, and PLIST conversion techniques.

Report Development:

Create high-quality, native-format reports using macOS tools to present artifacts accurately and clearly.

Secure Your Spot – Limited Seats Available!

Item #2

Topics to include but are not limited to:

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended.

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

MFSC-201: Online, Eastern Daylight Time
2026-03-09 - 2026-03-13
Advanced Practices in Mac Forensics will be presented by SUMURI from March 09 – 13 2026, 8:00 AM to 5:00 PM EDT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Pre-requisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Item #2

Topics to include but are not limited to:

Advanced macOS Artifact Analysis

Deep dive into property lists, SQLite databases, bundle files, and library directories to uncover key forensic evidence.

Advanced macOS Artifact Analysis:

Deep dive into property lists, SQLite databases, bundle files, and library directories to uncover key forensic evidence.

User and System Activity Reconstruction:

Identify user account changes, network connections, attached devices, and hibernation states to build detailed timelines.

Mastering macOS Timestamps:

Learn how to interpret POSIX and Apple Extended Attribute timestamps to track file and system events accurately.

Comprehensive Log Analysis:

Extract and interpret data from unified logs, domain-specific logs, and application logs to reveal user actions and system events.

Application Deconstruction:

Perform static and dynamic artifact analysis of first- and third-party applications to uncover hidden or unsupported evidence.

Advanced Command Line for Forensics:

Utilize macOS terminal commands to locate, extract, and analyze artifacts quickly and efficiently.

Time Machine and FSEvents Forensics:

Recover historical snapshots, identify file changes, and track system activity over time.

RAM, Virtual Machine, and iOS Artifact Analysis:

Examine volatile memory, virtual machine images, and iOS data stored on Macs.

Custom Forensic Tool Development:

Learn to script your own acquisition, triage, and data collection tools in Bash and Python.

macOS Automation for Investigations:

Leverage AppleScript and Automator to streamline repetitive forensic tasks.

Secure Your Spot – Limited Seats Available!

MFSC-101: Orlando, Florida
2026-04-27 - 2026-05-01
Best Practices in Mac Forensics will be presented by SUMURI from April 27 – May 1, 2026, 8:00 AM to 5:00 PM EDT.
SUMURI’s Macintosh Forensic Survival Course (MFSC-101) provides vendor-neutral training that covers the process of examining a Macintosh computer from the first step to the last step in logical order.
MFSC-101 is designed for both the beginner Mac examiner as well as the advanced. The knowledge you gain can be applied to any forensic tool on any platform. No sales pitch, just Mac forensics!

MFSC-101 is the first of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME).
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Overview of macOS Versions

Identifies features of forensic importance in different macOS and when they appeared

Understanding the Mac File System Technology

A review of all file system technology supported by macOS such as APFS, Core Storage, Fusion Drives, and macOS Extended

Intel Mac Technology and Bootcamp

Explains the forensic significance of Mac Intel Technology

Silicon Mac Technology

Explains the unique issues and forensic significance of M1 Silicon Technology

Mac Security Issues and FileVault Attacks

Current best practices for dealing with Mac Security

Macintosh Search and Seizure

Best practices for seizing Mac and iOS hardware

Safely Obtaining System Information

How to safely obtain system information without making changes to the evidence

Open Firmware Passwords

Explains OFP, how to set and remove OFP if it is necessary

Volatile Data Collection

Discussion on unique issues concerning Mac Volatile Data, methods to collect it, and the need for a Trusted Utilities Disk

Forensic Imaging

Discussion and exercises on imaging Intel and M1 Silicon Macs to include issues present by Mac security features

Imaging Mac RAM

Discussion on the challenges in capturing RAM due to macOS security features

Mounting Forensic Images in the macOS

Safely mounting forensic images for Processing and analysis

Indexing Forensic Images

How to index forensic images using macOS

Search Techniques Using macOS

Creating custom search expressions  from the command-line and GUI

Locating Evidence

How to identify, analyze and extract macOS and application artifacts such as Email, Graphics, Internet Artifacts, Documents, System Artifacts, Instant Messaging, logs, and more

Recovering Deleted Files

An exercise in manually recovering deleted files and the dangers of Mac optimization

Examining SQLite Databases and PLIST files

Examining the heart of Mac data storage

Using macOS for Forensics

How to utilize built-in macOS technology for forensics

Report Development

How to create native reports using the Mac to view data properly

Recommendations for Mac Forensics system configuration and hardware

Our recommendations for commercial and non-commercial tools to assist with Mac forensics.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.

LIMITED TIME OFFER

Use this coupon code below to get 15% discount.

“MFSC15”

MFSC-201: Orlando, Florida
2026-05-04 - 2026-05-08
Advanced Practices in Mac Forensics will be presented by SUMURI from May 4 – May 8, 2026, 8:00 AM to 5:00 PM EDT.
Advanced Practices in Mac Forensics (MFSC-201) builds upon the Best Practices in Mac Forensics (MFSC-101) course. MFSC-201 focuses on in-depth analysis techniques, which provide the students the ability to apply what they have learned in real-world cases.
Participants will engage in teamwork-based learning, guided by instructors dedicated to ensuring no one is left behind.
Prerequisite
Completion of MFSC-101 (or a comparable Mac Forensics course) is strongly recommended before taking MFSC-201.

MFSC-201 is the second of the two prerequisite courses required for the Certified Forensic Mac Examiner (CFME). Learn more about our training courses and how to become a CFME: https://sumuri.com/mac-training/
Start your journey to certification and elevate your expertise today!

Note:

Students will need access to a Mac computer running the current version of macOS for the course.

Register Here

Topics to include but are not limited to:

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced File System Analysis

Introduction to the concept of domains within the macOS environment and locations of evidentiary artifacts and their contents.

Advanced Command Line

Work with macOS’ powerful and highly useful command-line interface to assist in forensic examinations of a Mac.

macOS Log Analysis

Learn how to identify artifacts from persistent and volatile logs, including Apple Unified Logs.

File System Event Monitoring and Analysis

Work with live and logged File System Events to identify artifacts and determine file usage history on a volume or disk.

Identifying and Analyzing Virtual Machines

Identify the use of a VM within macOS and the procedures necessary to analyze artifacts.

AppleScript and Automator

Learn to develop custom programs and workflows to automate almost any task to simplify and enhance forensic examinations.

macOS Server & Software RAIDs

Discussion on macOS server technology and Apple software RAIDs. Learn the best practices on handling servers and Apple RAIDs.

Macintosh Timeline Analysis

Understand and identify unique macOS metadata timestamps for use in building a timeline of a file system that can retrace the suspect’s history minute by minute or second by second.

iCloud Forensics

Find and analyze iCloud artifacts and data, such as documents, synced with an Apple iCloud account.

Time Machine Analysis

Understand the Time Machine backup process and structure in order to find data.

Unique Apple Technology

Lean the best practices and resources available to deal with unique Apple technology such as Air Tags and Continuity.

Advanced Search Techniques

Use advanced search techniques, both macOS native and 3rd party tools, to find evidentiary artifacts within the macOS.

Application Deconstruction

Learn how to find any and all artifacts left behind by installed, and in some cases uninstalled, applications.

Secure Your Spot – Limited Seats Available!

Don’t miss out on this opportunity to enhance your capabilities as a Mac forensic expert. Book your accommodation at the Caribe Royale Hotel here. Prefer other accommodations? Just be aware that conference center parking fees may apply.
