GIAC (SANS)GIAC iOS and macOS Examiner
The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's computer forensic analysis and incident response skills for Mac and iOS systems. It is designed for experienced digital forensic analysts, law enforcement officers, and incident responders who need to analyze data from any Apple device. Earning GIME demonstrates you can conduct traditional investigations and intrusion analysis scenarios for compromised Apple devices.
403 practice questions · Updated 2026-07-30
4Domains
13Objectives
51Concepts
403Questions
GIME Curriculum
Every domain, objective, and concept the GIME exam measures.
- System acquisition vs. data types
- Apple system data types
- Disk image formats
- Mounting system images
- Basic Application Data Structures
- SQL Query Fundamentals
- Examining Application Data with SQL
- File System Operation Event Artifacts
- Operating System Use Artifacts
- Spotlight Artifacts
- Removable Media Device Artifacts
- Identify key log types
- Understand log locations and formats
- Correlate logs across sources
- Create an event timeline
- Validate timeline accuracy
- System Artifact Identification
- Artifact Correlation
- Behavioral Pattern Analysis
- Artifact Organization and Presentation
- Contacts Data Analysis
- Notes Data Analysis
- Wallet Data Analysis
- Photos Data Analysis
- Maps Data Analysis
- Screen Time Data Analysis
- Apple Watch Data Analysis
- Mail configuration analysis
- Mail data analysis
- Safari configuration analysis
- Safari data analysis
- Communication application analysis
- Reminder application analysis
- Document versioning fundamentals
- iCloud data architecture
- Comparing document versions
- iCloud data change detection
- Forensic artifacts of versioning
- System identifiers
- OS installation and backup dates
- Management profiles
- Network information
- User accounts
- Artifact Examination for Malicious Code
- Volatile System Artifact Analysis
- Memory Acquisition Methods
- Brute Force Techniques for Encrypted Data
- System Configuration Artifacts
- User Data Artifacts
- Artifact Location and Structure
- Artifact Analysis for Incident Response
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GIME, so none is invented.