MFSC-101 - Best Practices In Macintosh Forensics

Home » Digital Forensic Training » Mac Forensics 101

Best Practices In Macintosh Forensics
Vendor Neutral – Tool Agnostic – Cost-Effective

Best Practices in Macintosh Forensics (MFSC-101) provides detailed instruction on the process of examining a Macintosh computer from the first step to the last, in logical order.

MFSC-101 is the most up-to-date course on Mac Forensics, focusing on providing the student with in-depth knowledge and hands-on skills, allowing them to conduct an examination using any forensic tool on any platform.

Designed for Both Beginner and Advanced Mac Examiners

MFSC-101 provides the necessary knowledge to understand the intricacies of the macOS and how critical data is stored. This, along with advanced topics on macOS, provides the student with the tools to find, analyze and understand critical data which can be used in support of their investigations.

Featured Topics:

  • Apple Silicon & Intel Technology
  • Mac Security & Fire Vault
  • Apple Extended Metadata
  • Mac Imaging
Additional Topics:

  • Safely Obtaining System Information
  • Volatile Data Collection
  • Imaging and Acquisition
  • Verifying and Safely Mounting Forensic Images
  • Search Techniques Using macOS
  • Locating Evidence (Apple Native Applications)
  • Recovering Deleted Files
  • Examining SQLite Databases and PLIST files
  • Using macOS for Forensics

Course Requirements
Students are required to supply their own Mac laptops for this course. If you are unable to do so, please contact our office at

Become a Certified Forensic Mac Examiner

The Certified Forensic Mac Examiner (CFME) certification by SUMURI was developed by the leading experts and innovators in the field of Mac Forensics.

SUMURI’s MFSC-101 and MFSC-201 have been developed to provide advanced, in-depth training on Mac Forensics. Our courses concentrate on teaching the intricacies of the macOS, the Apple File Systems, and the techniques required to provide concise, detailed, and accurate information, whether testifying in court or reporting to a client. It is because of our constant updating of our materials and our remaining staunchly vendor-neutral, we know our courses focus only on what the student needs to accomplish their job when examining a Mac computer.

For these reasons, we stipulate both the MFSC-101 and MFSC-201 as prerequisites for the Certified Forensic Mac Examiner certification process.

Upcoming Courses