Advanced Smartphone Forensic Analysis Training

Advanced Smartphone Forensic Analysis Training; The usefulness of smartphones as a source of information in any investigation should never be underestimated, because they contain details about who was doing what, where and when. Smartphones are the new and improved personal computer, conveying communications and Internet access wherever we go, chronicling our private activities and geolocation details all the while. People and organizations are migrating rapidly to smartphones and other mobile devices, bringing with them an increasing quantity of digital evidence, sensitive information, and malicious attackers.

These private, portable embedded systems create a substantial opportunity and challenge for forensic practitioners, and create security risks for organizations that have smartphones on their networks. Specialized methods and tools are required to extract and analyze data from smartphones, such as communications, multimedia, location information, and malware. Advanced Smartphone Forensic Analysis Training is crucial for you to become an invaluable digital investigator equipped to exploit smartphones as a source of evidence and capable of responding to attacks against these devices.

Advanced Smartphone Forensic Analysis TrainingDuration: 5 days

RESOURCES
RELATED COURSES
CUSTOMIZE It
  • We can adapt this Advanced Smartphone Forensic Analysis Training course to your group’s background and work requirements at little to no added cost.
  • If you are familiar with some aspects of this Advanced Smartphone Forensic Analysis Training course, we can omit or shorten their discussion.
  • We can adjust the emphasis placed on the various topics or build the Advanced Smartphone Forensic Analysis Training Course around the mix of technologies of interest to you (including technologies other than those included in this outline).
  • If your background is nontechnical, we can exclude the more technical topics, include the topics that may be of special interest to you (e.g., as a manager or policy-maker), and present the Advanced Smartphone Forensic Analysis Training course in manner understandable to lay audiences.
AUDIENCE/TARGET GROUP

The target audience for this Advanced Smartphone Forensic Analysis Training course:

  • Experienced digital forensic examiners who want to extend their knowledge and experience to forensic analysis of mobile devices, especially smartphones
  • Media exploitation analysts who need to master Tactical Exploitation or Document and Media Exploitation operations on smartphones and mobile devices by learning how individuals used their smartphones, who they communicated with, and what files they accessed
  • Information security professionals who respond to data breach incidents and intrusions
  • Incident response teams tasked with identifying the role that smartphones played in a breach
  • Law enforcement officers, federal agents, and detectives who want to master smartphone forensics and expand their investigative skills beyond traditional host-based digital forensics
  • Accident reconstruction investigators who need to determine how a phone was accessed or used during specific periods of time
  • IT auditors who want to learn how smartphones can expose sensitive information
CLASS PREREQUISITES

The knowledge and skills that a learner must have before attending this Advanced Smartphone Forensic Analysis Training course are:

  • There is no prerequisite for this course, but a basic understanding of digital forensic file structures and terminology will help the student grasp topics that are more advanced. Previous training in mobile device forensic acquisition is also useful, but not required. We do not teach basic acquisition methods in class, but we do provide instructions about them in the bonus course material.
Advanced Smartphone Forensic Analysis Training - OBJECTIVES

Upon completing this Advanced Smartphone Forensic Analysis Training course, learners will be able to meet these objectives:

  • Extract more information from smartphones than any single forensic tool can provide, and recover deleted items that offenders thought were long gone
  • Recover and reconstruct events relating to illegal or unauthorized activities, and provide your organization the capabilities to utilize evidence on smartphones
  • Techniques and tools in the context of an overall forensic methodology, providing you with the ability to obtain and utilize digital evidence on smartphones and other mobile devices
Advanced Smartphone Forensic Analysis Training - COURSE SYLLABUS
DAY 1: FORENSIC ANALYSIS OF SMARTPHONES, FLASH MEMORY & SQLITE DATABASES

Any type of investigation can involve a smartphone, ranging from a source of evidence in homicides and terrorist attacks, to targets of identity theft and cyberattacks. Sex offenders have videotaped their crimes. Many vice officers and courts consider mobile devices to be an integral part of drug trafficking and dealing. Data thieves are developing malware specifically targeting smartphones. Although compact, mobile devices can contain significant digital evidence including schedules, memos, address books, e-mail messages, passwords, credit card numbers, and other personal information. As with all other specialized areas of digital forensics, a strong fundamental understanding of the underlying technology and data structures is vital for forensic examiners and investigators.

Skills You Will Learn:
  • Digital evidence on smartphones and connected systems
  • Smartphone investigation method
  • Forensic value of Flash memory
  • Forensic analysis of SIM cards
  • Data encoding on smartphones
  • Recovering deleted information in SQLite databases
  • Strengths and weaknesses of smartphone forensic tools
DAY 2-3: FORENSIC ANALYSIS OF ANDROID DEVICES AND APPS

Digital investigators need to understand the inner workings of Android devices and how they store data in order to extract and interpret the information they contain. To accomplish this goal, take a deep dive into Android devices using specialized smartphone forensics tools such as Autopsy, Cellebrite and IEF. We delve into the file system layout on Android devices and discuss common areas containing files of evidentiary value. Traces of user activities on Android devices are covered as well as recovery of deleted SQLite records and media files. We also perform timeline and link analysis, and other forensic reconstruction using data recovered from smartphones.

Skills You Will Learn:
  • Android forensics common challenges
  • Extracting and interpreting information from Android devices
  • Cracking locked and encrypted Android devices
  • Interpreting file systems on Android devices
  • Forensic examination of Android apps
  • Performing low-level forensic examination of data structures on Android devices
  • Locating information that is not generally accessible to users
  • Salvaging deleted data from Android devices
  • Performing advanced media carving on Android devices
  • Obtaining artifacts of user activities on Android devices
  • Analyzing SQLite databases on Android devices & recovering deleted information
  • Reconstruct events from multiple data sources associated with Android devices
DAY 3-4: FORENSIC ANALYSIS OF IOS DEVICES AND APPS

In order to extract and interpret the information on Apple mobile iOS devices, digital investigators need to understand their inner workings and how they store data. To accomplish this goal, we delve into the file system layout on iOS devices and discuss common areas containing files of evidentiary value. Encryption, decryption, backup file parsing, traces of user activities are covered in detail.

Skills You Will Learn:
  • iOS forensics common challenges
  • Extracting and interpreting information from iOS devices
  • Interpreting file systems on iOS devices
  • Performing low-level forensic examination of data structures on iOS devices
  • Locating information that is not generally accessible to users
  • Salvaging deleted data from iOS devices
  • Obtaining artifacts of user activities on iOS devices
DAY 4-5: BLACKBERRY, WINDOWS PHONE & CAPSTONE INVESTIGATIVE SCENARIO

Although Blackberry smartphones are well-designed to protect security and privacy, they can contain a variety of details about the user that can be useful in an investigation. In addition, given the increasing prevalence of Windows Phone/Mobile devices worldwide, it is important for forensic practitioners to understand how to locate and interpret useful information from these devices. Forensic analysts require a familiarity with interpreting and analyzing the information on Blackberry and Windows smartphones, and need to understand the limitations of existing methods for extracting data from these devices. Techniques and tools used for parsing common data structures on Blackberry and Windows devices, and recovering any deleted items.

Skills You Will Learn:
  • Extracting and interpreting information from Blackberry and Windows devices
  • Interpreting file systems on Blackberry and Windows devices
  • Performing low-level forensic examination of data structures on Blackberry and Windows devices
  • Salvaging deleted data from Blackberry and Windows devices
  • Obtaining artifacts of user activities on Blackberry and Windows devices
  • Applying what you learned to a final capstone investigative scenario.
Ultimately, Advanced Smartphone Forensic Analysis will help you answer fundamental investigative questions:
  1. Who used a smartphone?
  2. What did the user do on a smartphone?
  3. Who did the user communicate with using a smartphone?
  4. Where was the smartphone located at key times?
  5. Details about online activities conducted using a smartphone.
  6. What information was deleted from a smartphone?
Advanced Smartphone Forensic Analysis Training Course Wrap-Up

Whether you are looking for general information or have a specific question, we want to help.
Request More Information

    Time frame: