GIAC iOS and macOS Examiner (GIME) icon

GIAC iOS and macOS Examiner (GIME)

Practitioner Certification

The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's knowledge of Mac and iOS computer forensic analysis and incident response skills. GIME-certified professionals are well-versed in traditional investigations as well as intrusion analysis scenarios for compromised Apple devices.

Areas Covered

  • Mac and iOS File Systems, System Triage, and Application Data
  • Mac and iOS Incident Response, Malware, and Intrusion Analysis
  • Mac and iOS User Data and Timeline Analysis

Who is GIME for?

  • Experienced Digital Forensic Analysts
  • Law Enforcement Officers, Federal Agents, and Detectives
  • Media Exploitation Analysts
  • Incident Response Team Members
  • Information Security Professionals who want to become knowledgeable about macOS and iOS system internals.
  • SANS DFIR Alumni looking to round out their forensic skills.

Exam Format

  • 1 proctored exam
  • 75 questions
  • 2 hours
  • Minimum passing score of 67%

*No specific training is required for any GIAC certification. There are many sources of information available regarding the certification objectives' knowledge areas. Practical experience is an option; there are also numerous books on the market covering computer information security. Another option is any relevant courses from training providers, including SANS.*


NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.

GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.

Exam Certification Objectives & Outcome Statements

  • Apple Application Analysis
    The candidate will analyze configurations and data for contacts, notes, wallet, photos, maps, screen time and apple watch applications.
  • Apple File System Artifacts
    The candidate will examine event artifacts created by file system operations, operating system use, Spotlight, and removable media devices.
  • Apple Systems Triage
    The candidate will prepare system triage with fundamental system artifacts. Triage information includes system identifiers, OS installation and backup dates, management profiles, network information, and user accounts.
  • Application Fundamentals
    The candidate will identify basic application data structures and construct SQL queries to examine the data.
  • Document and iCloud analysis
    The candidate will distinguish changes across document versions and iCloud data.
  • Encrypted Container and Memory Analysis
    The candidate will identify memory acquisition methods and use brute force techniques to access encrypted data for analysis
  • Incident Response
    The candidate will examine artifacts created by malicious code and analyze volatile system artifacts.
  • Introduction to Apple Operating Systems
    The candidate will differentiate between system acquisition and data types available for analysis.
  • Introduction to Disk and File Systems
    The candidate will identify key data types associated with Apple systems and mount system images for analysis.
  • Log Analysis and Timeline Creation
    The candidate will correlate key log types and create an event timeline.
  • Pattern of Life
    The candidate will organize system based artifacts to track user behavior and habits.
  • Productivity Application Analysis
    The candidate will analyze configurations and data for mail, safari, communication, and reminder applications.
  • User Data and System Configuration
    The candidate will identify artifacts created from system configuration and user data.

Other Resources

  • Training is available in a variety of modalities including live conference training, online, and self-study.
  • Practical work experience can help ensure that you have mastered the skills necessary for certification
  • College-level courses or study through another program may meet the needs for mastery.
  • The procedure to contest exam results can be found at

Practice Tests

  • These tests are a simulation of the real exam allowing you to become familiar with the test engine and style of questions.
  • Practice exams are a gauge to determine if your preparation methods are sufficient.
  • The practice bank questions are limited so you may encounter the same question on practice tests when multiple practice tests are purchased.
  • Practice exams never include actual exam questions.
  • Purchase a GIME practice test here.
  • GIAC recommends leveraging additional study methods for test preparation.

Find Affiliate Training

Explore affiliate training options to prepare for your GIAC certification exam.