macOS Endpoint Investigation

What macOS Endpoint Investigation teaches: how to reconstruct an incident from the evidence a Mac leaves behind. The investigation questions you'll answer, the open-source toolstack you'll work, the honest limits of Apple Silicon and FileVault, and how the course is structured across Sequoia 15 and macOS 26 Tahoe. Start here.

The model a macOS investigator holds before any technique makes sense: why the platform is targeted, how an intrusion actually runs, and the security stack read as a set of recorders. SIP, Gatekeeper and quarantine, XProtect, TCC, code signing and the sealed volume, FileVault and Lockdown Mode, and the custody discipline that makes any of it admissible.

Where evidence lives on a Mac, in what format, and why the architecture puts it there: APFS containers and volume roles, the firmlinked tree, Mach-O binaries and universal slices, bundles against installer packages, launchd as the persistence surface, property lists and extended attributes, SQLite and its sidecars, and the routing method that turns a question into a collection list.

Getting evidence off a modern Mac and turning it into something somebody else can rely on: why the classical workflow does not apply, scope against format, the five volatility classes, collection frameworks and parsers, the keybag and its crypto users, the routes that remain when the device is closed, and the three layers of a defensible package.

The richest source on a Mac and the first with a deadline: what the store is made of, how to query it, the language that filters it, which components record security-relevant events, why so much of it reads as private, and how to turn it into a timeline that can be merged with everything else.

What a Mac records about its own files: five timestamps rather than three, a changelog with no clock in it, an index that knows when a person opened something, snapshots and backups that hold the file itself, a store of what documents used to say, and the cross-checks that catch a date somebody set by hand.

How software arranges to run again on a Mac: launch items and the keys that trigger them, the registry that records three mechanisms and alerts the user, the five that it does not cover, profiles that grant what no launch item can reach, libraries loaded inside applications that inherit their permissions, and the sweep that finds all of it.

Proving what ran on a Mac when the platform keeps no execution log: quarantine and provenance attributes, assessment and notarization records, silent malware scans, the usage stores, the policy database, install receipts, and how to assemble them into a claim that survives being checked.

Establishing what a person did on a Mac: browser and messaging artifacts behind the privacy gate, the device-state streams, the menu-selection stream introduced in Tahoe, clipboard history, recent-items lists, the keychain inventory, and how to build a timeline that distinguishes the machine from the account.

What a Mac records about the networks it joined, the devices near it, the files it transferred by proximity, and the remote services it exposed, and how to assemble those into a picture that distinguishes configuration from communication.

Reading a Mach-O binary without running it: the header and its slices, the load commands that create positions, the signature and what it proves, notarization and its documented limits, anti-analysis measures and their base rates, and how a file-level reading becomes a finding about a machine.

What a Mac can say about devices you do not hold: the two lanes and the half you are missing, a binding that is not activity, a listing that is not the bytes, requirements narrow enough to exclude, a second party who can act, the document that separates policy from compromise, the backup that outlives the phone, and the population you establish before reading anything.

Building a macOS timeline and knowing what it can support: the encodings and semantics behind a timestamp, the two-stage build, reading by pivot rather than in order, the confidence an ordering carries, the two tells that expose a backdated file, what a protection state proves, and the report that survives somebody trying to take it apart.

The FOR503 capstone. Work a complete compromised macOS endpoint end to end on a case you have not seen: acquisition, initial access and execution, persistence, malware triage, user activity and staging, the exfiltration channel, anti-forensics, the unified timeline, and the honest findings package. Applies every technique from Modules 1 to 12. Across macOS Sequoia 15 and macOS 26 Tahoe.

macOS artifact commands by investigation area, each with the fields that carry the decision and what the output does not establish.

Seven procedures a macOS examiner repeats: acquiring a machine you cannot image the old way, opening it without changing it, triaging in an hour, and proving something ran.

Building a macOS environment that produces real artifacts to practice against, on hardware you probably already own, across both versions the course targets.

Seven macOS examinations worked end to end, including the wrong turns, the bounded answers, and the cases where the evidence could not support the question asked.

Seven macOS threats, each with the examination sequence that establishes what happened, the check that could end it, and what the handoff must carry.

Where to practice macOS investigation and use it at work: your own Mac first, then the toolkit, the detection library, guided investigations and response playbooks.

Apple platform documentation, macOS forensic artifact resources, open-source tooling, vendor and community research, and forensic standards used throughout the macOS Endpoint Investigation course.

macOS Endpoint Investigation end-of-course exam: a simulation-based assessment testing your ability to acquire, investigate, and report on a macOS intrusion you have not seen before, using the artifacts and the method built across all fourteen modules.