forensics.training

What It Is

forensics-training currently presents a three-day in-person course titled “iOS Threat Hunting – Detecting Advanced Malware,” scheduled for October 12–14, 2025, at the Ibiza Congress Center and associated with the OBTS v8.0 setting. The course aims to help participants understand and detect advanced iOS malware and spyware, with threats mentioned including Pegasus, Graphite, Reign, Predator, Hermit, Candiru, and others.

Core Content and Teaching Format

The course sits at the intersection of iOS digital forensics and mobile security, with an emphasis on a forensic-based approach. Its structure is 40% hands-on practice and 60% theory. Day 1 covers the iOS security model, attack models, malicious apps and jailbreak detection, as well as the creation of forensic artifacts. Day 2 focuses on using artifacts such as backups, Sysdiagnose, Crashlogs, and Unified Logs to detect known and unknown attacks, along with automated analysis using open-source tools. Day 3 continues with unknown-attack detection and includes a case study of a public Pegasus exploit chain, sample acquisition, and sample analysis. For technical requirements, participants need to bring a Mac running at least macOS Big Sur, and are encouraged to bring an iOS device; the instructor will provide some devices, including jailbroken ones.

Instructor, Pricing, and Certificate

The instructor, Matthias, has a strong background: in his day job, he leads a research team at iVerify focused on iOS malware detection methods; he previously worked on mobile device malware protection at a major German infrastructure company, and has delivered talks and trainings at conferences such as OBTS, HITB, and BlackHat. The price is 3000 euros plus tax, with limited seats available. Payment can be made via CopeCart, and invoices can be issued if needed. Note that an OBTS conference ticket is not included in the training fee and must be purchased separately. The page does not state whether a certificate of completion is provided, nor does it clearly specify the teaching language.

Pros, Cons, and Suitable Audience

Its main strengths are the highly specialized and relatively rare topic, coverage of real forensic artifacts, unknown-attack detection, and a Pegasus case study. It is best suited to learners who already have a foundation in security or forensics and want to deepen their capabilities. The downsides are the high price, in-person-only format, and location in Ibiza; Chinese participants would need to bear additional costs for travel, visa, accommodation, and conference tickets. The course also expects familiarity with iOS, malware concepts, and the macOS terminal. Python/SQL experience is not required but would be helpful, so it is not suitable as a zero-background beginner course.

Access from China and Alternatives

The text provides no evidence on whether the website is reliably accessible directly from mainland China, so this remains unknown. For payment, only a CopeCart checkout link is shown, with no indication of support for common Chinese payment methods. If attending is not feasible, alternatives to watch include BlackHat Trainings, SANS digital forensics courses, HITB/OBTS-related trainings, or domestic courses focused on mobile security, iOS forensics, and malware analysis.