MFSC-201 - Advanced Practices in Macintosh Forensics

Home » Digital Forensic Training » Mac Forensics 201

Advanced Practices in Macintosh Forensics
Vendor Neutral – Tool Agnostic – Cost-Effective

Advanced Practices in Mac Forensics (MFSC-201) builds upon the material presented in the Best Practices in Mac Forensics course.

MFSC-201 takes the students into in-depth analysis techniques, which provides the students the ability to apply what they have learned in real world cases. The knowledge you gain from SUMURI’s training can be applied to any forensic tool on any platform.

MFSC-201 goes into detail on multiple topics, which are updated prior to each class to reflect changes made by Apple that affect how Mac examinations can be conducted. We are constantly researching, testing and updating our course content in order to bring the student the most up to date information possible.

Featured Topics:

  • Advanced File System Analysis
  • macOS Log Analysis
  • Event Monitoring & Analysis
  • Automation
  • Time Machine Analysis
Additional Topics:

  • Advanced Command Line
  • Identifying and Analyzing Virtual Machines
  • macOS RAID Forensics
  • Mac Timeline Analysis
  • iCloud Forensics
  • Unique Apple Technology
  • Application Deconstruction
  • Advanced Search Techniques
  • Air Tag Analysis
  • macOS Triage
Course Requirements
Students are required to supply their own Mac laptops for this course. If you are unable to do so, please contact our office at

Become a Certified Forensic Mac Examiner

The Certified Forensic Mac Examiner (CFME) certification by SUMURI was developed by the leading experts and innovators in the field of Mac Forensics.

SUMURI’s MFSC-101 and MFSC-201 have been developed to provide advanced, in-depth training on Mac Forensics. Our courses concentrate on teaching the intricacies of the macOS, the Apple File Systems, and the techniques required to provide concise, detailed, and accurate information, whether testifying in court or reporting to a client. It is because of our constant updating of our materials and our remaining staunchly vendor-neutral, we know our courses focus only on what the student needs to accomplish their job when examining a Mac computer.

For these reasons, we stipulate both the MFSC-101 and MFSC-201 as prerequisites for the Certified Forensic Mac Examiner certification process.

Upcoming Courses