Mobile forensics classes provide with knowledge of cell phone and mobile device forensic examinations and the necessary principles to recover and preserve data using mobile forensics tools in the correct manner to ensure the safe preservation of data. The information provided is extensive and covers all aspects of basic examinations of SIM cards, memory cards, feature phones, GPS navigation devices, and smartphones. There are three levels of this course: basic, intermediate and advanced. All levels include different hands-on exercises.
Basic Course
This entry-level program is the starting point for those tasked with identifying and seizing mobile devices for data acquisition. The course will address legal considerations, standard operating procedures, and best practices for seizing and searching devices. Key serial numbers included in every investigation and their importance will be explained. Extraction methods will be introduced and demonstrated, followed by practical exercises that include SIM card, physical, file system, and logical extractions. After successful extractions, participants will analyze the extracted data using forensic tools. Recognizing various locking mechanisms found on Android and iPhone devices will be taught, along with an overview and analysis of both operating systems. Participants in this course will gain a basic understanding of how to open the extractions in mobile forensics software, perform basic searches, and how to create bookmarks and reports. Participants will conduct verification and validation of decoded data, which is one of the most important steps in the forensic investigation.
Prerequisites
Students should have a basic understanding of digital forensics procedures and Windows operating system.
Intermediate Course
This course is a follow-up to Mobile Forensics Basic course. It will address more advanced topics such as: physical acquisition, examination of collected data, carving and parsing of deleted data, combined with practical exercises using the latest tools available on the market. The main topics that will be covered by this course are Android and iOS file system analysis, application analysis, databases and advanced extractions. The course will also cover the analysis of internet artefacts, email, chat, picture and documents. Lastly, the class will also cover analysis of cloud data, legacy and feature phone mobile operating systems. Each day includes extensive hands on exercises. At the end of the course, all participants will take on an exam and after successful completion will be given an official certificate for passing the course
Prerequisites
Passed Mobile Forensics Basic class, good knowledge of mobile forensics tools, good knowledge of Windows operating systems. Basics of terminal commands.
Advanced Course
This course is a follow-up to Basic and Intermediate Mobile Forensics course. The main goal is to cover devices that are not supported by the main mobile forensics tool. The topics that will be covered include dealing with unsupported devices, obtaining data from unsupported devices and analysis of such data. The course will include JTAG procedures, introduction to chip off technique, custom parsing and connecting various devices for analysis, usage of various tools, connection kits, unbricking and other various advanced techniques applicable in mobile forensics cases.
Prerequisites
Good knowledge of Windows operating systems, Mobile Forensics Basic course, Mobile Forensics Intermediate course
