Anyone can run the First Look cases free, no account and no watermark. Open a First Look case →First Look cases · free, no account. Open one →
Sign in Learn for free
Home / Pathways / macOS Forensics
Cert prep · Digital Forensics · aligned to the published SANS FOR518 objectives

macOS forensics labs, one case at a time

Mac forensics, as the FOR518 objectives frame it, expects an examiner who knows where macOS keeps its own records: download provenance in the quarantine database and Safari history, privacy consent in the TCC database, persistence in LaunchAgents and LaunchDaemons, and the unified log entries that tie them together.

This pathway starts with two First Look cases, one on where an app came from and one on what each app is allowed to see. It then traces persistence back to its download, correlates TCC, quarantine and unified-log records on a Mac whose user suspects monitoring, works a departing employee's Mac, and closes with a capstone that puts five macOS artifacts on one timeline.

Start a free 30-day trial Download the sample lab

6 cases · ~6 h 3 min of lab time · Easy to Hard · a different variant for everyone · verified answer keys

The pathway, in order

6 cases, about 6 h 3 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.

  1. 01

    First Look: Where Did This Mac App Come From?

    Trace a download with the quarantine database and Safari history.

    EASY~33 minUp to 15 questions
  2. 02

    First Look: What Can Each App See?

    Read the system and user TCC privacy databases and their consent records.

    EASY~33 minUp to 15 questions
  3. 03

    Login Loop (A Launch Agent That Shouldn't Be There)

    Trace macOS persistence back to its download.

    MEDIUM~1 h 6 minUp to 15 questions
  4. 04

    Consent Granted (Who Is Watching the Screen?)

    Correlate TCC, quarantine and unified-log records.

    MEDIUM~1 h 1 minUp to 20 questions
  5. 05

    Parting Gift (Mac Insider: Data Out the Back Door)

    Work shell, browser and unified-log history on a departing employee's Mac.

    HARD~1 h 15 minUp to 15 questions
  6. 06

    House Guest (Mac Under Full Control)

    Capstone: five macOS artifacts, one timeline.

    HARD~1 h 35 minUp to 20 questions

What this pathway covers

FoundationsmacOS ForensicsAdvanced Forensics & IRAligned to the published SANS FOR518 objectivesEasy to Hard

Who it's for

  • Candidates preparing for a macOS forensics course or exam who want to work real plists, SQLite databases and log output rather than slides.
  • Instructors adding Apple endpoints to a forensics course who need graded labs that don't require a Mac to solve.
  • Enterprise responders with a Mac fleet who have never had to read a TCC database under pressure.

What you get with every case

  • A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
  • Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
  • A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
  • One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
  • Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.

Run this pathway with your own roster

Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.

Start a free 30-day trial Open the sample lab

Related pathways

DFIR Analyst Onboarding

The first-look triage skills across every evidence family, in the order a new analyst should meet them.

10 cases · ~6 h 22 min

Insider-Threat Investigator

Data theft, snooping and policy violations by people who already had access.

6 cases · ~14 h 9 min

All learning pathways

Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.

Browse the overview →

GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.