Uncertain Times — Infosec's here to help. Learn about our COVID-19 Response Package.

Mobile Forensics Boot Camp

Learn how to use mobile forensics to investigate cybercrime! Our Mobile Forensics Boot Camp builds your skills in a hands-on lab environment so you can apply what you learned the day you leave training.

Train from home — save up to $1,000

Get expert, live instruction without having to travel with an Infosec Flex Pro boot camp. We’ve trained 1,000s of students online over the past 5 years, helping our clients meet their career goals wherever they are most comfortable studying.

Now through the end of the month, you can enroll in any online Infosec Flex boot camp and save up to $1,000.

Earn your CMFE, guaranteed!

Boot camp overview

This highly technical, hands-on boot camp is designed to provide you with in-depth coverage of critical techniques and information about identifying, preserving, extracting, analyzing and reporting forensic evidence on mobile devices through use of the most popular mobile forensic tools. You will learn about the challenges of mobile forensics, walk through the analysis and examination of mobile devices, and gain deep understanding of differences in evidence locations and examination techniques in Android, iOS and Windows phones. Extracting cloud data and examining feature phones is also covered.

This boot camp also prepares you to become a Certified Mobile Forensics Examiner (CMFE) and provides practical, hands-on labs that help you to hit the ground running the day your boot camp ends.

Skill up and get certified, guaranteed

Exam Pass Guarantee

If you don’t pass your exam on the first attempt, get a second attempt for free. Includes the ability to re-sit the course for free for up to one year.

100% Satisfaction Guarantee

If you’re not 100% satisfied with your training at the end of the first day, you may withdraw and enroll in a different Flex Pro or Flex Classroom course.

Knowledge Transfer Guarantee

If an employee leaves within three months of obtaining certification, Infosec will train a different employee at the same organization tuition-free for up to one year.

What's included?

93% pass rate — the best in the industry

  • Two days of training with an expert forensics instructor
  • Infosec proprietary digital courseware (physical textbooks available to purchase)
  • CMFE exam voucher
  • 90-day access to cyber range (Flex Pro)
  • 90-day access to course replays (Flex Pro)
  • Curated videos from other top-rated instructors (Flex Pro)
  • 100% Satisfaction Guarantee
  • Exam Pass Guarantee (Flex Pro)

Limited-time offer: Continue learning after your boot camp with a complimentary 90-day subscription to Infosec Skills, which includes unlimited access to 500+ online courses, 100+ hands-on labs and projects, skill assessments, custom certification practice exams and more.

Hands-on labs

Our scenario-based, hands-on labs simulate a real cybercrime investigation. You’ll gain practical skills in locating and examining evidence on devices and forensic images, as well as analyzing and reporting findings. You’ll work with with various commercial and open-source forensic tools within our unique cloud-based learning environment.

Award-winning training that you can trust

Infosec Skills

Best IT Security-related Training Program

Cyber Work with Chris Sienko

Best Cybersecurity Podcast

2019 Wisconsin Innovation Award


Rising Star

Partner Award

G2 Crowd Leader

Technical Skills Development Software

Who should attend?

  • Law enforcement professionals looking to expand into mobile crime investigations
  • Legal professionals
  • IT and information security professionals being tasked with mobile forensics and incident handling
  • Anyone with a desire to learn about mobile forensics and develop their skills


Students must have no criminal record. Basic computer skills, including the ability or desire to work outside the Windows GUI interface, are necessary. A+ certification and/or similar training and experience is not required, but recommended.

This is a very in-depth training course and is not intended for individuals who have limited or no computer skills.

Why choose Infosec

Your flexible learning experience

Infosec Flex makes expert, live instruction convenient with online and in-person formats tailored to how, when and where you learn best.

Public training boot camps held nationwide

  • Pre-study course materials
  • Live instruction
  • Digital courseware
  • Daily reinforcement materials
  • Catered lunches
  • Infosec community forum access
  • 100% Satisfaction Guarantee
  • Knowledge Transfer Guarantee

Most Popular

Immersive, live-streamed instruction

  • Pre-study course materials
  • Live instruction
  • Digital courseware
  • Daily reinforcement materials
  • Detailed performance reporting
  • Video replays
  • 90-day extended access to materials
  • Infosec community forum access
  • Exam Pass Guarantee
  • 100% Satisfaction Guarantee

Tailored team training at your location

  • Pre-study course materials
  • Live, customized instruction at your location
  • Digital courseware
  • Daily reinforcement materials
  • Detailed team performance reporting
  • Video replays
  • 90-day extended access to materials
  • Infosec community forum access
  • Exam Pass Guarantee
  • 100% Satisfaction Guarantee
  • Knowledge Transfer Guarantee

What you’ll learn

This training immerses you in mobile forensics and investigations through engaging lectures and hands-on labs. Some of the topics covered include:

  • Applying advanced computer forensics analysis concepts to mobile devices
  • File carving tools and techniques
  • The HFS+ file system
  • Browsing the devices with SSH
  • Reading SQLlite data stores
  • Jailbreaking
  • Breaking device encryption keys
  • Data protection for keychain items
  • Recovering keyboard caches
  • Recovering deleted photo library and camera roll images
  • Recovering deleted browser cache items and other personal data
  • Recovering hidden call history data
  • Recovering map tiles from maps application
  • Analyzing cached and deleted email messages
  • Analyzing recovered SMS messages with timestamp data
  • Analyzing deleted voicemails
  • Establishing trusted pairing relationships with one or more desktop computers
  • Writing forensic reports

Certification details

This boot camp prepares you to become a Certified Mobile Forensics Examiner. The CMFE certification validates your knowledge of five domains related to the mobile forensics evidence recovery and analysis process:

  • Mobile forensics process
  • Android forensics
  • iOS forensics
  • Windows phones
  • Feature phone forensics

Can’t get away for a week?

Learn mobile forensics on-demand.

Get the cybersecurity training you need at a pace that fits your schedule with a subscription to Infosec Skills. Includes unlimited access to hundreds of additional on-demand courses — plus cloud-hosted cyber ranges where you can practice and apply knowledge in real-world scenarios — all for just $34 a month!

  • 70+ learning paths
  • 500+ courses
  • Cloud-hosted cyber ranges and hands-on projects
  • Skill assessments and certification practice exams
  • Infosec community peer support

You're in good company.

"I’ve taken five boot camps with Infosec and all my instructors have been great."

Jeffrey Coa

Information Security Systems Officer

"Comparing Infosec to other vendors is like comparing apples to oranges. My instructor was hands-down the best I’ve had." 

James Coyle

FireEye, Inc.

"I knew Infosec could tell me what to expect on the exam and what topics to focus on most."

Julian Tang

Chief Information Officer

Our clients

Bank of America
Defense Information Systems Agency

Find your boot camp

Mobile Forensics Boot Camp details

Day 1

Mobile forensics introduction

  • Types of devices
  • GPS
  • Cell phones
  • Tablets
  • Vendor and carrier identification
  • Obtaining information from cellular provider
  • GSM vs. CDMA
  • Common tools and methodology

Mobile forensics process

  • Mobile forensics challenges
    • OS variety
    • Differences in hardware and filesystems
    • Security features
    • Data volatility
    • Cloud storage
  • Types of evidence found on mobile devices
  • Collecting mobile devices at the scene
    • Locating devices
    • Preserving volatile data
    • Physical components and accessories (SIM cards, SD cards, chargers, etc.)
    • Older phones and devices
  • Comparison of mobile operating systems
    • Android
    • iOS
    • Windows phone
    • Blackberry OS
  • Data acquisition methods
    • Logical acquisition
    • Physical acquisition
    • Manual acquisition
  • Reporting findings

Android forensics

  • Android platform
    • Hardware
    • SDK and debug bridge
    • File systems and data structures
  • Android security model
    • Secure kernel and permissions
    • Full disk encryption
    • App security
  • Bypassing Android security features
    • Bootloader/recovery mode
    • Rooting an Android device
    • Lock screen bypassing techniques
  • Android logical data acquisition and analysis
    • Extracting the /data directory
    • Device information
    • SMS/MMS, email, browsing and social networking data
    • App and cloud data
  • Android physical data acquisition
    • Hardware-based techniques
    • JTAG
    • Chip-off
    • Android data recovery techniques

Day 2

iOS forensics

  • Apple iOS platform
    • iOS devices and hardware
    • iOS versions, file system and architecture
  • iOS security
    • Passcode and Touch ID
    • Privilege separation
    • ASLR and data execution prevention
    • Encryption
  • Bypassing iOS security features
    • Operating modes of iOS devices
    • Custom RAMDisk
    • Jailbreaking
    • Bypassing passcode
    • Breaking iOS device encryption keys
    • Establishing trusted communication with desktop computer
  • iOS data acquisition and analysis
    • SQLite databases
    • Property lists
    • Other important files (cookies, keyboard cache, recordings, etc.)
  • iPhone/iCloud backups
    • Backup structure
    • Extracting and examining unencrypted backups
    • Encrypted backups (extracting and decrypting the keychain)
  • iOS data recovery techniques

Windows phones

  • Windows Phone OS: partitions and filesystems
  • Windows Phone security features
    • Secure boot
    • Application security and data protection
  • Windows Phone logical acquisition and analysis
    • Sideloading
    • Extracting SMS, email and application data
  • Windows 10 mobile OS forensics

Feature phones forensics

  • Acquiring and examining data from feature phones