GIAC iOS and macOS Examiner (GIME)

• Mac and iOS File Systems, System Triage, and Application Data
• Mac and iOS Incident Response, Malware, and Intrusion Analysis
• Mac and iOS User Data and Timeline Analysis

• Experienced Digital Forensic Analysts
• Law Enforcement Officers, Federal Agents, and Detectives
• Media Exploitation Analysts
• Incident Response Team Members
• Information Security Professionals who want to become knowledgeable about macOS and iOS system internals.
• SANS DFIR Alumni looking to round out their forensic skills.

• 1 proctored exam
• 75 questions
• 2 hours
• Minimum passing score of 67%

NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.

GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.

• Apple Application Analysis
  The candidate will analyze configurations and data for contacts, notes, wallet, photos, maps, screen time and apple watch applications.
• Apple File System Artifacts
  The candidate will examine event artifacts created by file system operations, operating system use, Spotlight, and removable media devices.
• Apple Systems Triage
  The candidate will prepare system triage with fundamental system artifacts. Triage information includes system identifiers, OS installation and backup dates, management profiles, network information, and user accounts.
• Application Fundamentals
  The candidate will identify basic application data structures and construct SQL queries to examine the data.
• Document and iCloud analysis
  The candidate will distinguish changes across document versions and iCloud data.
• Encrypted Container and Memory Analysis
  The candidate will identify memory acquisition methods and use brute force techniques to access encrypted data for analysis
• Incident Response
  The candidate will examine artifacts created by malicious code and analyze volatile system artifacts.
• Introduction to Apple Operating Systems
  The candidate will differentiate between system acquisition and data types available for analysis.
• Introduction to Disk and File Systems
  The candidate will identify key data types associated with Apple systems and mount system images for analysis.
• Log Analysis and Timeline Creation
  The candidate will correlate key log types and create an event timeline.
• Pattern of Life
  The candidate will organize system based artifacts to track user behavior and habits.
• Productivity Application Analysis
  The candidate will analyze configurations and data for mail, safari, communication, and reminder applications.
• User Data and System Configuration
  The candidate will identify artifacts created from system configuration and user data.

• Training is available in a variety of modalities including live conference training, online, and self-study.
• Practical work experience can help ensure that you have mastered the skills necessary for certification
• College-level courses or study through another program may meet the needs for mastery.
• The procedure to contest exam results can be found at https://www.giac.org/policies/feedback.

Practice Tests

• These tests are a simulation of the real exam allowing you to become familiar with the test engine and style of questions.
• Practice exams are a gauge to determine if your preparation methods are sufficient.
• The practice bank questions are limited so you may encounter the same question on practice tests when multiple practice tests are purchased.
• Practice exams never include actual exam questions.
• Purchase a GIME practice test here.
• GIAC recommends leveraging additional study methods for test preparation.