- How the GIME Objectives Are Organized
- Exam Format and Logistics at a Glance
- Foundation Domains: Systems, Disks, and Application Basics
- Artifact Domains: Where the Evidence Lives
- Analysis Domains: Memory, Logs, Timelines, and Pattern of Life
- Triage and Incident Response Domains
- Domain Groupings Compared
- Sequencing Your Prep Across the 13 Areas
- Building an Open-Book Index Around the Domains
- Who Uses These Skills
- Frequently Asked Questions
- GIAC lists 13 certification objectives for GIME, but publishes no percentage weights, so no domain can be ranked as heaviest.
- The exam is open book with 75 questions in 2 hours; electronic references and the internet are prohibited.
- The minimum passing score is 67% for exam versions released on or after June 2, 2022.
- Answers cannot be reviewed or changed after submission, so commit only once you have checked your index.
How the GIME Objectives Are Organized
The GIAC iOS and macOS Examiner (GIME) certification validates a practitioner's ability to examine Apple devices and operating systems in a forensic or incident response context. GIAC publishes the exam scope as a list of certification objectives with outcome statements. For this guide, those objectives are treated as 13 content areas, listed in the issuer's own order and capitalization.
One point of honesty before going further: the "13 domains" framing is a count of the objective headings, not a claim that GIAC calls them 13 weighted domains. GIAC does not publish percentage weights for these areas, and no public outline revision number or separate 2026 blueprint is shown. That means any article claiming "Domain 7 is 18% of the exam" is inventing data. This guide will not do that.
If you are new to the credential itself, start with What Is GIME Certification? for background, then return here for the objective-by-objective breakdown.
Exam Format and Logistics at a Glance
Knowing the delivery mechanics shapes how you study each domain, especially because the exam is open book and your reference materials are physical.
- Questions and time: one web-based proctored exam with 75 questions in 2 hours.
- Delivery: onsite at Pearson VUE or remote with ProctorU, subject to availability for the purchased attempt.
- Passing score: 67% minimum for exam versions released on or after June 2, 2022.
- Activation window: 120 days from activation to completion, which is separate from the 2 hours of exam time.
- Materials: printed books, notes, and an index are permitted; electronic references, internet access, and materials resembling practice or exam questions and answers are prohibited.
- No review: submitted answers cannot be reviewed or changed.
Several details are not publicly specified in the sources reviewed: the scored versus unscored split, the exact item-type mix, whether there is a GIME-specific practical component, calculator rules, whether the format is adaptive, and the population pass rate. Do not assume a lab-style component from another GIAC exam applies here. For score mechanics, see GIME Passing Score 2026: Exactly What You Need to Pass, and for scheduling, GIME Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Foundation Domains: Systems, Disks, and Application Basics
Four of the 13 objectives establish the conceptual base that everything else sits on. If you are coming from a Windows-heavy forensic background, these are where your assumptions will be tested first.
Domain 8: Introduction to Apple Operating Systems
This objective frames how macOS and iOS are structured and how they differ from the platforms examiners usually meet.
- Understand the relationship and differences between macOS and iOS as evidence sources.
- Know how the Apple ecosystem links devices, which later explains why artifacts appear in unexpected places.
- Build vocabulary you will rely on in every other domain.
Domain 9: Introduction to Disk and File Systems
Before you can interpret artifacts, you need to understand where data physically and logically resides.
- Learn how storage is partitioned and presented on Apple hardware.
- Understand how file systems record, store, and sometimes retain data.
- Recognize how acquisition choices affect what an examiner can later see.
Domain 4: Application Fundamentals
Apple applications follow structural conventions that make their data findable once you know the pattern.
- Understand how applications are packaged and where they keep user data.
- Learn the common storage formats examiners encounter inside app containers.
- Use this knowledge as the bridge to the application analysis domains below.
Domain 13: User Data and System Configuration
Configuration and user data answer questions about who used a system and how it was set up.
- Identify where user accounts and preferences are recorded.
- Understand how system settings can corroborate or contradict a suspect's account.
- Practice reading configuration artifacts as evidence, not just metadata.
These foundations are also where most newcomers decide how hard the exam will feel. For a candid look, read How Hard Is the GIME Exam? Complete Difficulty Guide 2026.
Artifact Domains: Where the Evidence Lives
The largest cluster of objectives concerns specific artifact families. Expect questions that ask you to identify what a given artifact proves, where it is located, or how to interpret what it contains.
Apple File System Artifacts (Domain 2)
This objective covers evidence that comes from the file system itself. Think about timestamps, metadata, and file system behaviors that persist even when users believe they have deleted or moved something. Candidates should be able to reason about what the file system can and cannot tell them about activity.
Apple Application Analysis (Domain 1)
Where Domain 4 teaches how applications store data, Domain 1 is about analyzing what that data means. Native Apple applications often hold rich communication, location, and usage records. The skill tested is interpretation: moving from a database table or property file to a defensible statement about user behavior.
Productivity Application Analysis (Domain 12)
Productivity software generates its own trail of documents, versions, and recent-item records. This objective asks you to understand those traces and what they reveal about how content was created or accessed.
Document and iCloud analysis (Domain 5)
Apple's cloud and document handling extends the evidence beyond the device. This objective reflects a reality of modern investigations: a document may exist locally, in the cloud, or in synchronization metadata that indicates it once existed. Understand how synchronization leaves artifacts and how to distinguish local activity from synced activity.
Analysis Domains: Memory, Logs, Timelines, and Pattern of Life
Another group of objectives is about technique rather than a single artifact type. These are where you combine sources to answer investigative questions.
Domain 6: Encrypted Container and Memory Analysis
Encryption and volatile data change what is recoverable and how.
- Understand how encrypted containers affect access to evidence.
- Recognize what memory can reveal that disk analysis cannot.
- Know the limits: what you can and cannot conclude when data is protected.
Domain 10: Log Analysis and Timeline Creation
Logs and timelines turn scattered artifacts into a narrative.
- Learn how Apple systems record events and where those records reside.
- Practice correlating timestamps across sources into a coherent sequence.
- Understand the pitfalls of time interpretation when sources disagree.
Domain 11: Pattern of Life
Pattern of life analysis infers routine and behavior from device activity over time.
- Identify artifacts that reflect user presence, movement, and device interaction.
- Distinguish evidence of user action from automated system activity.
- Frame conclusions carefully, since inference is not the same as proof.
Timeline work is a recurring thread: Domains 10 and 11 build directly on the artifact families above, so expect these to feel integrative rather than isolated. A candidate who understands the artifacts but not the correlation logic will find these objectives the hardest to apply.
Triage and Incident Response Domains
Two objectives place forensic skill in an operational context, where speed and scoping matter as much as depth.
Apple Systems Triage (Domain 3)
Triage is about deciding what to examine first and how to gather high-value information quickly. This is distinct from full forensic examination. Candidates should understand how to prioritize sources and how to assess a system efficiently when time or access is limited.
Incident Response (Domain 7)
This objective applies Apple-specific knowledge to security incidents. Rather than a purely evidentiary mindset, you consider scoping, containment-relevant findings, and how to recognize signs of compromise on macOS and iOS. It pairs naturally with the log, memory, and application domains.
Key Takeaway
Treat Domains 3 and 7 as consumers of everything else. Triage and incident response questions usually require you to choose the right artifact source for a situation, so your confidence there depends on how well you know the artifact domains first.
Domain Groupings Compared
The table below groups the 13 objectives by the kind of thinking each demands. The grouping is an organizing aid for study, not an official GIAC categorization, and it carries no weighting.
| Group | Objectives | Primary Skill |
|---|---|---|
| Foundations | Domain 8, Domain 9, Domain 4, Domain 13 | Recall of structure, vocabulary, and configuration locations |
| Artifacts | Domain 2, Domain 1, Domain 12, Domain 5 | Identifying artifacts and interpreting their meaning |
| Analysis techniques | Domain 6, Domain 10, Domain 11 | Correlation, inference, and handling protected data |
| Operational response | Domain 3, Domain 7 | Prioritization and applying findings to incidents |
Sequencing Your Prep Across the 13 Areas
Because no official weights exist, avoid over-investing in one area based on rumor. A sensible approach is to sequence by dependency: foundations first, artifacts second, techniques third, and operational domains last. Here is one way to map the groupings onto a schedule. For a fuller plan, see GIME Study Guide 2026: How to Pass on Your First Attempt.
Foundations
- Domains 8 and 9: operating system and file system concepts.
- Domain 4: application structure basics.
Configuration and Core Artifacts
- Domain 13: user data and system configuration.
- Domain 2: file system artifacts.
Application and Cloud Evidence
- Domains 1 and 12: Apple and productivity application analysis.
- Domain 5: document and iCloud analysis.
Techniques
- Domain 6: encrypted container and memory analysis.
- Domains 10 and 11: log analysis, timelines, and pattern of life.
Operations and Integration
- Domains 3 and 7: triage and incident response.
- Timed practice across all 13 areas using GIME practice tests.
This sequencing is deliberate: the technique and operational objectives assume fluency with artifacts, so scheduling them late lets earlier study pay off twice.
Building an Open-Book Index Around the Domains
The exam is open book, but only with permitted printed books, notes, and an index. Electronic references are out. That makes an index the single most valuable preparation artifact you can produce, and the 13 objectives give you a natural skeleton for it.
- Tag entries by domain. When a question describes a scenario, you want to jump to the relevant objective's material quickly.
- Index artifact locations and meanings. Many questions test whether you know where something lives and what it proves.
- Cross-reference related domains. Timeline and pattern of life entries should point back to the artifact entries they depend on.
- Avoid prohibited material. Do not bring anything resembling practice or exam questions and answers.
For a condensed reference, compare your own notes against GIME Cheat Sheet 2026: One-Page Review of Must-Know Facts, remembering that your own index, built from your own study, is what actually serves you in the exam.
Who Uses These Skills
The 13 objectives map to work done by digital forensic examiners, incident responders, and security analysts who encounter Apple devices in investigations. Roles in corporate security teams, consulting, and law enforcement-adjacent forensic labs commonly draw on this kind of knowledge. Specific salary or hiring figures are not published by the issuer, so this guide makes no numerical claims. For career context, see GIME Jobs, GIME Salary Guide 2026: Complete Earnings Analysis, and Is the GIME Certification Worth It? Complete ROI Analysis 2026.
Costs and Eligibility in Brief
There are no formal prerequisites. Training is recommended rather than compulsory, and there is no mandatory education, work-hour, or training-hour requirement. FOR518 describes working knowledge of forensics and the Unix command line as useful, but those are course recommendations, not GIME eligibility requirements. The certification attempt is USD $999, a retake is $899, a practice exam is $399, an attempt extension is $479, and renewal is $499, all excluding applicable sales tax. SANS training and affiliate bundles are priced separately. The standard extension adds 45 days, subject to a 570-day maximum access limit. The credential is valid for 4 years and renews through 36 CPEs or by passing the renewal exam with the renewal fee. See GIME Certification Cost 2026: Complete Pricing Breakdown and GIME Requirements 2026: Eligibility, Prerequisites & How to Qualify for the full picture.
Frequently Asked Questions
No. GIAC lists 13 certification objectives with outcome statements but does not publish percentage weights or identify a highest-weighted objective, so any specific weighting claim should be treated as unverified.
The exam has 75 questions and a 2-hour time limit. It is web-based and proctored, delivered either onsite through Pearson VUE or remotely through ProctorU, subject to availability.
The minimum passing score is 67% for exam versions released on or after June 2, 2022. This is a passing threshold, not a pass rate; the population pass rate is not publicly specified in the reviewed sources.
Permitted printed books, notes, and an index are allowed. Electronic references, internet access, and materials resembling practice or exam questions and answers are prohibited, and answers cannot be reviewed or changed after submission.
No. There are no formal prerequisites and training is recommended rather than compulsory. See the GIME Training overview for options, and review GIME Pass Rate 2026: What the Data Shows for what is and is not known about outcomes.
With the 13 objectives mapped, the next step is testing yourself against them. Use the GIME practice test platform to see which domains need more work before you schedule your attempt.