Mobile Forensics Boot Camp
Learn how to use mobile forensics to investigate cybercrime! Our Mobile Forensics Boot Camp builds your skills in a hands-on lab environment so you can apply what you learned the day you leave training.
Earn your CMFE, guaranteed!
- Exam Pass Guarantee
- 100% Satisfaction Guarantee
- CMFE exam voucher
- Unlimited CMFE practice exam attempts
- Two days live, expert forensics instruction
- Immediate access to Infosec Skills from the minute you enroll to 90 days after your boot camp
- Learn by doing with 100s of additional hands-on courses and labs
- 90-day access to all boot camp video replays and materials
- Knowledge Transfer Guarantee
Hands-on labs
Our scenario-based, hands-on labs simulate a real cybercrime investigation. You’ll gain practical skills in locating and examining evidence on devices and forensic images, as well as analyzing and reporting findings. You’ll work with with various commercial and open-source forensic tools within our unique cloud-based learning environment.
Training overview
This highly technical, hands-on boot camp is designed to provide you with in-depth coverage of critical techniques and information about identifying, preserving, extracting, analyzing and reporting forensic evidence on mobile devices through the use of the most popular mobile forensic tools. You will learn about the challenges of mobile forensics, walk through the analysis and examination of mobile devices, and gain a deep understanding of differences in evidence locations and examination techniques in Android, iOS and Windows phones. Extracting cloud data and examining feature phones is also covered.
This boot camp also prepares you to become a Certified Mobile Forensics Examiner (CMFE) and provides practical, hands-on labs that help you to hit the ground running the day your boot camp ends.
What you’ll learn
- Applying advanced computer forensics analysis concepts to mobile devices
- File carving tools and techniques
- The HFS+ file system
- Browsing the devices with SSH
- Reading SQLlite data stores
- Jailbreaking
- Breaking device encryption keys
- Data protection for keychain items
- Recovering keyboard caches
- Recovering deleted photo library and camera roll images
- Recovering deleted browser cache items and other personal data
- Recovering hidden call history data
- Recovering map tiles from maps application
- Analyzing cached and deleted email messages
- Analyzing recovered SMS messages with timestamp data
- Analyzing deleted voicemails
- Establishing trusted pairing relationships with one or more desktop computers
- Writing forensic reports
Certification details
This boot camp prepares you to become a Certified Mobile Forensics Examiner. The CMFE certification validates your knowledge of five domains related to the mobile forensics evidence recovery and analysis process:
- Mobile forensics process
- Android forensics
- iOS forensics
- Windows phones
- Feature phone forensics
Who should attend?
- Law enforcement professionals looking to expand into mobile crime investigations
- Legal professionals
- IT and information security professionals being tasked with mobile forensics and incident handling
- Anyone with a desire to learn about mobile forensics and develop their skills
Prerequisites
Students must have no criminal record. Basic computer skills, including the ability or desire to work outside the Windows GUI interface, are necessary. A+ certification and/or similar training and experience is not required but recommended.
This is a very in-depth training course and is not intended for individuals who have limited or no computer skills.
Everything you need to earn your CMFE
- Exam Pass Guarantee
- 100% Satisfaction Guarantee
- CMFE exam voucher
- 2 days live, expert forensics instruction
- Mobile forensics boot camp prep course
- Learn by doing with 100s of additional hands-on courses and labs
- 90-day access to all boot camp video replays and materials
- Knowledge Transfer Guarantee
Exam Pass Guarantee
We guarantee you’ll pass your exam on the first attempt. Learn more.
Mobile forensics training schedule
Infosec’s mobile forensics training is more than just a boot camp. We support you before, during and after your live training to ensure you’re fully prepared for your exam — and get certified on your first attempt.
- Before your boot camp
-
Start learning now. You’ll get immediate access to all the content in Infosec Skills so you can prepare for your live boot camp, uncover your knowledge gaps and maximize your training experience.
-
- During your boot camp
-
Day 1
Mobile forensics introduction
- Types of devices
- GPS
- Cell phones
- Tablets
- Vendor and carrier identification
- Obtaining information from cellular provider
- GSM vs. CDMA
- Common tools and methodology
Mobile forensics process
- Mobile forensics challenges
- OS variety
- Differences in hardware and filesystems
- Security features
- Data volatility
- Cloud storage
- Types of evidence found on mobile devices
- Collecting mobile devices at the scene
- Locating devices
- Preserving volatile data
- Physical components and accessories (SIM cards, SD cards, chargers, etc.)
- Older phones and devices
- Comparison of mobile operating systems
- Android
- iOS
- Windows phone
- Blackberry OS
- Data acquisition methods
- Logical acquisition
- Physical acquisition
- Manual acquisition
- Reporting findings
Android forensics
- Android platform
- Hardware
- SDK and debug bridge
- File systems and data structures
- Android security model
- Secure kernel and permissions
- Full disk encryption
- App security
- Bypassing Android security features
- Bootloader/recovery mode
- Rooting an Android device
- Lock screen bypassing techniques
- Android logical data acquisition and analysis
- Extracting the /data directory
- Device information
- SMS/MMS, email, browsing and social networking data
- App and cloud data
- Android physical data acquisition
- Hardware-based techniques
- JTAG
- Chip-off
- Android data recovery techniques
Day 2
iOS forensics
- Apple iOS platform
- iOS devices and hardware
- iOS versions, file system and architecture
- iOS security
- Passcode and Touch ID
- Privilege separation
- ASLR and data execution prevention
- Encryption
- Bypassing iOS security features
- Operating modes of iOS devices
- Custom RAMDisk
- Jailbreaking
- Bypassing passcode
- Breaking iOS device encryption keys
- Establishing trusted communication with desktop computer
- iOS data acquisition and analysis
- SQLite databases
- Property lists
- Other important files (cookies, keyboard cache, recordings, etc.)
- iPhone/iCloud backups
- Backup structure
- Extracting and examining unencrypted backups
- Encrypted backups (extracting and decrypting the keychain)
- iOS data recovery techniques
Windows phones
- Windows Phone OS: partitions and filesystems
- Windows Phone security features
- Secure boot
- Application security and data protection
- Windows Phone logical acquisition and analysis
- Sideloading
- Extracting SMS, email and application data
- Windows 10 mobile OS forensics
Feature phones forensics
- Acquiring and examining data from feature phones
-
- After your boot camp
-
Your Infosec Skills access extends 90 days past your boot camp, so you can take additional time to prepare for your CMFE exam, get a head start on your next certification goal or start earning CPEs.
-
Free mobile forensics training resources
Sign up