GIME Cheat Sheet 2026: One-Page Review of Must-Know Facts

Exam Snapshot: The Numbers You Must Know

This page condenses what you need to know about the GIAC iOS and macOS Examiner (GIME) into a form you can review in a single sitting. It covers the format, the money, the rules, and the thirteen published objective headings. For deeper treatment of any item, follow the links to the longer guides. If you want to test yourself against realistic questions, the GIME practice tests are built for exactly that.

What GIAC Does Not Publish

Several details candidates often ask about are simply not specified in the public sources. GIAC does not state the scored versus unscored split, the exact mix of item types, whether there is a GIME-specific practical component, the calculator rules, whether the exam is adaptive, or a population pass rate. Do not assume features from other GIAC exams carry over. In particular, do not assume a CyberLive-style practical section exists here just because another certification has one. Plan for 75 questions in 2 hours and treat anything beyond that as unconfirmed.

Simple arithmetic helps with pacing. With 75 questions in 120 minutes, you have about 96 seconds per question on average. Because the exam is open book, the real danger is not running out of knowledge but running out of time while flipping through pages. That is why your index matters so much, which we cover below.

Fees, Windows, and Extensions at a Glance

GIAC lists its prices excluding applicable sales tax, and no member versus non-member schedule is published. SANS training and affiliate bundles carry separate pricing, so the figures below apply only to GIAC's standalone certification products.

The 120-Day Window and Extensions

Once you activate an attempt, you have a 120-day window to complete it. That window is separate from the 2 hours of exam time. A standard extension adds 45 days, and all access is subject to a 570-day maximum access limit. Your purchase-specific delivery terms and your GIAC account govern the actual attempt, so check your own account for the exact dates that apply to you.

The practical lesson: do not activate your attempt until your index is built and you have completed at least one full practice pass. An extension costs $479, which is a steep price for poor timing. For the full cost picture, including what is and is not bundled, read GIME Certification Cost 2026: Complete Pricing Breakdown. For scheduling mechanics, see GIME Exam Dates 2026: Testing Windows, Deadlines & Scheduling.

Open-Book Rules: What You Can and Cannot Bring

GIME is open book, but the rule is narrower than the name suggests. Permitted materials are printed books, notes, and an index. Prohibited items include electronic references, internet access, and any materials resembling practice or exam questions and answers.

That last prohibition catches people out. A binder stuffed with practice-question printouts and answer keys is not a legitimate reference. Build notes in your own words, organized by topic, not as a copy of question banks. The remote and onsite proctoring processes are described in GIAC's proctor program overview and reference guide, so review those before test day if you are testing remotely.

No Going Back

Submitted answers cannot be reviewed or changed. Treat each submission as final. If a question is unclear, spend your time reading it carefully before committing rather than counting on a second pass. This is a significant difference from exams that let you flag and revisit items, and it shapes pacing: do not rush early and plan to fix mistakes later, because there is no later.

The 13 Objectives on One Page

The exam objectives come from GIAC's published certification objectives and outcome statements, with scope verified on the GIAC GIME page. The list below preserves GIAC's order and capitalization. Note the framing carefully: these are 13 objective headings supplied by the issuer, not 13 officially weighted domains. GIAC publishes no percentage weights and does not identify a highest-weighted objective. Any site telling you "Domain 7 is 20% of the exam" is guessing.

Artifact Categories Worth Memorizing

Because the objectives are headings rather than detailed outlines, you must translate each into concrete knowledge. The groupings below help you organize what to look for, based on the heading names themselves. Verify specific file paths and tool behavior against your course materials, since this page deliberately avoids asserting details GIAC has not published.

Questions on a forensic examiner exam typically ask what an artifact tells you, where you would look for it, or how you would interpret a finding. Organizing your knowledge by evidence type, as above, mirrors how an examiner thinks and makes your index easier to build.

Building the Index That Saves You

In an open-book exam with roughly 96 seconds per question, your index is your highest-leverage asset. A well-built index turns a two-minute page hunt into a ten-second lookup. A poor one is worse than none, because it creates false confidence.

Index Principles for GIME

• Index by artifact and by question. Include entries for the artifact name, the question you would ask ("where is X recorded?"), and the concept.
• Add the book and page. Every entry should point to a specific location.
• Include objective headings as top-level categories. This lets you jump to a whole area when a question spans several artifacts.
• Note terminology variants. Apple tools and artifacts are often called different things in different sources. Cross-reference them.
• Keep it printed and legible. Electronic references are prohibited, and small unreadable text will cost you seconds you do not have.

For a complete preparation approach beyond the index, see GIME Study Guide 2026: How to Pass on Your First Attempt.

Scheduling Your Review by Domain

Generic study advice is everywhere, so this section ties scheduling directly to GIME's structure. The logic is simple: study foundations first because later objectives depend on them, then evidence sources, then the reconstruction objectives that combine everything. Adjust the pace to your own timeline and your 120-day window.

Because GIAC does not publish weights, do not skip any objective on the assumption that it is minor. Spread your effort evenly at first, then shift time toward the areas where your practice results show gaps. Honest difficulty context is covered in How Hard Is the GIME Exam? Complete Difficulty Guide 2026.

Where the Credential Gets Used

GIME targets practitioners who examine Apple devices: digital forensics examiners, incident responders, and investigators who encounter Macs and iPhones in their casework. The objective headings, such as Incident Response, Log Analysis and Timeline Creation, and Pattern of Life, point toward investigative and response roles rather than general IT administration.

This page does not cite salary figures or hiring statistics because none are published in the reviewed sources. For the career side, see GIME Jobs, GIME Salary Guide 2026: Complete Earnings Analysis, and Is the GIME Certification Worth It? Complete ROI Analysis 2026.

Prerequisites in Practice

There are no formal prerequisites: no mandatory education, work-hour, training-hour, or reference requirement was identified. Training is recommended rather than compulsory. The FOR518 course description separately notes that working knowledge of forensics and the Unix command line is useful, but that is a course recommendation, not a GIME eligibility requirement. Details are in GIME Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Validity and Renewal Quick Reference

Your certification is valid for 4 years. You can renew in either of two ways: earn 36 CPEs or pass the renewal exam, and in both cases pay the renewal fee, listed at $499.

Plan your CPE collection across the four-year cycle rather than scrambling near the end. For background on the credential itself, see What Is GIME Certification? and GIME Training.

Frequently Asked Questions