macOS investigation is its own discipline, not Windows forensics with different file paths. The artifacts you reach for first do not exist here, and the platform keeps a record you have never had: a behavioral timeline of what the user did, alongside the execution, persistence, and network evidence every investigation needs. This course teaches you to acquire a modern Mac correctly, read each of its evidence stores, and assemble findings that hold up, with honest treatment of what the system does and does not record. It targets both macOS Sequoia 15 and macOS 26 Tahoe, because the Macs on your bench are a mix of both and the artifacts shift between releases. You finish able to take a Mac, or a collection from one, and answer what ran, what persisted, what the user did, and what left the machine, backed by corroborated evidence and a stated confidence level.