Apple® Forensic Investigations

Triage and Analysis of macOS/iOS

Delivery Options

Students may attend this course through the following methods:

  • In-person classroom style training
  • Online through a live, virtual delivery of our course from your work or home. Our live virtual course features access to a virtual examination system, direct access to live instructors, and a virtual course manual.
  • Self-paced online training features access to trainings recorded by the primary course developers so you get the training directly from the source.

Please select “view all upcoming courses” to register.


True to its name, Apple® Forensic Investigations is composed of the essential techniques that every forensic professional needs. Specially crafted by our expert instructors, this course has something for every level of forensic experience.

Course Description

Apple® Forensic Investigations is the perfect way to quickly and effectively learn how to navigate the most important Mac, iPhone, and iPad device areas. For years, BlackBag has remained a highly reliable, go-to resource when detectives and investigators need advice regarding what to do with seized digital devices, in terms of both acquiring and analyzing evidence. The BlackBag team consistently remains abreast of the latest developments and techniques in digital forensics, and their research and experience with real-world cases act as the framework for the training courses. As a result, the example scenarios discussed in the classroom are driven by relevant data and realistic challenges. In short, BlackBag’s instructors will use their wealth of knowledge and firsthand experience with forensic examinations to help students learn all the tips and tricks needed to successfully complete their work.

Through hands-on learning and case-based scenarios, students will learn from experts how to perform both triage and analysis of specific data artifacts that exist within Apple’s devices, including operating system and file system artifacts. This course will guide students through the most important macOS and iOS device areas. The macOS and iOS operating systems, HFS+ and APFS file systems and significant application data are explored.

To learn more, view the course syllabus here.


Course Length: 5 days
Course Credit: 36 hours – In-person classroom style and live virtual training includes course assessment (32 hours of curriculum).  Self-paced online training includes built-in practical assessments throughout the course with 60-day access to learning modules.

Course Objectives

Upon concluding this course, students will have reviewed up to three different case scenarios covering various file system, operating system and application artifacts relevant to real-life cases. Analysis methodologies are covered via hands-on work with actual data and instructor-led exercises. Knowledge is reinforced with practical assessments. Through an interactive, hands-on approach, students will gain a strong familiarity of macOS and iOS artifacts and the confidence with which to conduct thorough examinations.

Course Requirements

While all are welcome, strong computer skills and an understanding of basic forensic concepts (imaging, live data acquisition, and evidence handling) are highly recommended for the optimal experience in this course.

  • For live virtual trainings, students will be provided a remote virtual student analysis system. A computer with reliable internet is required to access it.
  • For self-paced online trainings, students will work through the lessons on their own systems from provided course materials. The hardware specifications for operating BlackLight for the practical analysis exercises are:  Running MacOS 10.14+ or Windows 8 or later (Windows 10 preferred), 2.8GHz Intel i7, 16GB RAM, and minimum 100GB of storage space available.


The course is fee-based. Please login to see pricing.

Please login to see pricing and book a class. Login/Signup

Add BlackBag To Your Toolkit

See how easy it is to make BlackBag part of your everyday carry with a free trial or quote.