GIAC - iOS and macOS Examiner (GIME)

Duration

Duration:

Just 2 Days

Method

Method:

Classroom / Online / Hybrid

Next date

Next date:

24/6/2024 (Monday)

Overview

This accelerated GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

Forensic professionals need tool independent training and certification to show they can tackle any Mac or iOS investigation whether it is traditional forensics or incident response. The GIME certification provides students the confidence they need to analyse data from any Apple device.

In just 2 days, you’ll also learn:

  • Mac and iOS File Systems, System Triage, User and Application Data Analysis
  • Mac and iOS Incident Response, Malware, and Intrusion Analysis
  • Mac and iOS Memory Forensics and Timeline Analysis

At the end of this course, you’ll sit the GIAC exam, and achieve your GIAC iOS and macOS Examiner (GIME) certification. Through Firebrand’s Lecture | Lab | Review methodology, you’ll get certified at twice the speed of the traditional training and get access to courseware, learn from certified instructors, and train in a distraction-free environment.

 

Audience

This course is ideal for:

  • Experienced Digital Forensic Analysts
  • Law Enforcement Officers, Federal Agents, and Detectives
  • Media Exploitation Analysts
  • Incident Response Team Members
  • Information Security Professionals who want to become knowledgeable about macOS and iOS system internals.
  • SANS DFIR Alumni looking to round out their forensic skills.

Four reasons why you should sit your course with Firebrand Training

  1. You'll be trained and certified faster. Learn more on this 2-day accelerated course. You'll get at least 12 hours a day of quality learning time in a distraction-free environment
  2. Your course is all-inclusive. One simple price covers all course materials, exams, accommodation and meals – so you can focus on learning
  3. Pass first time or train again for free. Your expert instructor will deliver our unique accelerated learning methods, allowing you to learn faster and be in the best possible position to pass first time. In the unlikely event that you don't, it's covered by your Certification Guarantee
  4. Study with an award-winning training provider. We've won the Learning and Performance Institute's "Training Company of the Year" three times. Firebrand is your fastest way to learn, with 134.561 students saving more than one million hours since 2001

Curriculum

  • Module 1: Apple Application Analysis
  • The candidate will analyze configurations and data for contacts, notes, wallet, photos, maps, screen time and apple watch applications.
  • Module 2: Apple File System Artifacts
  • The candidate will examine event artifacts created by file system operations, operating system use, Spotlight, and removable media devices.
  • Module 3: Apple Systems Triage
  • The candidate will prepare system triage with fundamental system artifacts. Triage information includes system identifiers, OS installation and backup dates, management profiles, network information, and user accounts.
  • Module 4: Application Fundamentals
  • The candidate will identify basic application data structures and construct SQL queries to examine the data. Document and iCloud analysis
  • The candidate will distinguish changes across document versions and iCloud data.
  • Module 5: Incident Response
  • The candidate will examine artifacts created by malicious code and analyse volatile system artifacts. Introduction to Apple Operating Systems
  • The candidate will differentiate between system acquisition and data types available for analysis.
  • Module 6: Introduction to Disk and File Systems
  • The candidate will identify key data types associated with Apple systems and mount system images for analysis.
  • Module 7: Log Analysis and Timeline Creation
  • The candidate will correlate key log types and create an event timeline.
  • Module 8: Memory and Encrypted Container Analysis
  • The candidate will analyse memory captures and use brute force techniques to access encrypted data for analysis.
  • Module 9: Pattern of Life
  • The candidate will organize system based artifacts to track user behaviour and habits.
  • Module 10: Productivity Application Analysis
  • The candidate will analyse configurations and data for mail, safari, communication, calendar and reminder applications.
  • Module 11: User Data and System Configuration
  • The candidate will identify artifacts created from system configuration and user data.

Exam Track

  • At the end of this accelerated course, you’ll sit the following exam at the Firebrand Training centre, covered Certification Guarantee:

    GIAC iOS and macOS Examiner (GIME) exam

    • Duration: 2 hours
    • Format: 1 proctored exam
    • Number of questions: 75 questions
    • Passing score: Minimum passing score of 67%

What's Included

Your accelerated course includes:

  • Accommodation *
  • Meals, unlimited snacks, beverages, tea and coffee *
  • On-site exams **
  • Exam vouchers **
  • Practice tests **
  • Certification Guarantee ***
  • Courseware
  • Up-to 12 hours of instructor-led training each day
  • 24-hour lab access
  • Digital courseware **
  • * For residential training only. Accommodation is included from the night before the course starts. This doesn't apply for online courses.
  • ** Some exceptions apply. Please refer to the Exam Track or speak with our experts
  • *** Pass first time or train again free as many times as it takes, unlimited for 1 year. Just pay for accommodation, exams, and incidental costs.

Prerequisites

There are no prerequisites for this accelerated course.

Are you ready to get certified in record time?

We interview all applicants for the course on their technical background, degrees and certifications held, and general suitability. If you get through this screening process, it means you stand a great chance of passing.

Firebrand Training is an immersive training environment. You must be committed to the course. The above prerequisites are guidelines, but many students with less experience have other background or traits that have enabled their success in accelerated training through Firebrand Training.

If you have any doubts as to whether you meet the pre-requisites please call 89 88 66 05 and speak to one of our enrolment consultants, who can help you with a training plan.

Reviews

We've currently trained 134.561 students in 12 years. We asked them all to review our Accelerated Learning. Currently,
96,41% have said Firebrand exceeded their expectations:

"Best way to fully focus for complex certifications while benefiting from the real-life experience of the instructor"
Anonymous. (4/9/2023 (Monday) to 8/9/2023 (Friday))

"The instructor has a wealth of knowledge in OT, controls and automation. This especially true within the Oil and Gas industry. The training was significantly enhanced through this real-world experience and his ability interact with the class to cover off syllabus topics."
Anonymous. (28/11/2022 (Monday) to 2/12/2022 (Friday))

"Ive used Firebrand several times now over multiple job roles. I found this course GICSP was the most interesting course so far. This was hugely down to the instructor's interaction with the team and his shared real life scenarios. He is very knowledgeable indeed and presents the course in such a manner he made the subject feel much easier than it was. Its obvious that he is both passionate and dedicated in what he does. I look forward to attending onsite next year with him as the tutor"
Dave white, Essar Oil. (28/11/2022 (Monday) to 2/12/2022 (Friday))

"The GICSP training was excellent!"
AS. (28/11/2022 (Monday) to 2/12/2022 (Friday))

"Firebrand are well organised and their facilities, accommodation and training rooms are more than fit for purpose. The all-inclusive course represents good value and I would not hesitate to recommend to a friend or colleague, and have already done so!"
P.J., EDF Energy. (26/4/2021 (Monday) to 30/4/2021 (Friday))

Course Dates

Start

Finish

Status

Location

Book now

19/2/2024 (Monday)

20/2/2024 (Tuesday)

Finished - Leave feedback

-

 

24/6/2024 (Monday)

25/6/2024 (Tuesday)

Wait list

Nationwide

 

5/8/2024 (Monday)

6/8/2024 (Tuesday)

Limited availability

Nationwide

 

16/9/2024 (Monday)

17/9/2024 (Tuesday)

Open

Nationwide

 

28/10/2024 (Monday)

29/10/2024 (Tuesday)

Open

Nationwide

 

9/12/2024 (Monday)

10/12/2024 (Tuesday)

Open

Nationwide

 

Latest Reviews from our students