This highly technical, hands-on boot camp is designed to provide you with in-depth coverage of critical techniques and information about identifying, preserving, extracting, analyzing and reporting forensic evidence on mobile devices through use of the most popular mobile forensic tools. You will learn about the challenges of mobile forensics, walk through the analysis and examination of mobile devices, and gain deep understanding of differences in evidence locations and examination techniques in Android, iOS and Windows phones. Extracting cloud data and examining feature phones is also covered.

This boot camp also prepares you to become a Certified Mobile Forensics Examiner (CMFE) and provides practical, hands-on labs that help you to hit the ground running the day your boot camp ends.

• Two days of training with an expert forensics instructor
• Infosec proprietary digital courseware (physical textbooks available to purchase)
• CMFE exam voucher
• 90-day access to cyber range (Flex Pro)
• 90-day access to course replays (Flex Pro)
• Curated videos from other top-rated instructors (Flex Pro)
• 100% Satisfaction Guarantee
• Exam Pass Guarantee (Flex Pro)

Our scenario-based, hands-on labs simulate a real cybercrime investigation. You’ll gain practical skills in locating and examining evidence on devices and forensic images, as well as analyzing and reporting findings. You’ll work with with various commercial and open-source forensic tools within our unique cloud-based learning environment.

• Law enforcement professionals looking to expand into mobile crime investigations
• Legal professionals
• IT and information security professionals being tasked with mobile forensics and incident handling
• Anyone with a desire to learn about mobile forensics and develop their skills

Students must have no criminal record. Basic computer skills, including the ability or desire to work outside the Windows GUI interface, are necessary. A+ certification and/or similar training and experience is not required, but recommended.

This is a very in-depth training course and is not intended for individuals who have limited or no computer skills.

This training immerses you in mobile forensics and investigations through engaging lectures and hands-on labs. Some of the topics covered include:

• Applying advanced computer forensics analysis concepts to mobile devices
• File carving tools and techniques
• The HFS+ file system
• Browsing the devices with SSH
• Reading SQLlite data stores
• Jailbreaking
• Breaking device encryption keys
• Data protection for keychain items
• Recovering keyboard caches
• Recovering deleted photo library and camera roll images
• Recovering deleted browser cache items and other personal data
• Recovering hidden call history data
• Recovering map tiles from maps application
• Analyzing cached and deleted email messages
• Analyzing recovered SMS messages with timestamp data
• Analyzing deleted voicemails
• Establishing trusted pairing relationships with one or more desktop computers
• Writing forensic reports

This boot camp prepares you to become a Certified Mobile Forensics Examiner. The CMFE certification validates your knowledge of five domains related to the mobile forensics evidence recovery and analysis process:

• Mobile forensics process
• Android forensics
• iOS forensics
• Windows phones
• Feature phone forensics

Day 1

Mobile forensics introduction

• Types of devices
• GPS
• Cell phones
• Tablets
• Vendor and carrier identification
• Obtaining information from cellular provider
• GSM vs. CDMA
• Common tools and methodology

Mobile forensics process

• Mobile forensics challenges
  • OS variety
  • Differences in hardware and filesystems
  • Security features
  • Data volatility
  • Cloud storage
• Types of evidence found on mobile devices
• Collecting mobile devices at the scene
  • Locating devices
  • Preserving volatile data
  • Physical components and accessories (SIM cards, SD cards, chargers, etc.)
  • Older phones and devices
• Comparison of mobile operating systems
  • Android
  • iOS
  • Windows phone
  • Blackberry OS
• Data acquisition methods
  • Logical acquisition
  • Physical acquisition
  • Manual acquisition
• Reporting findings

Android forensics

• Android platform
  • Hardware
  • SDK and debug bridge
  • File systems and data structures
• Android security model
  • Secure kernel and permissions
  • Full disk encryption
  • App security
• Bypassing Android security features
  • Bootloader/recovery mode
  • Rooting an Android device
  • Lock screen bypassing techniques
• Android logical data acquisition and analysis
  • Extracting the /data directory
  • Device information
  • SMS/MMS, email, browsing and social networking data
  • App and cloud data
• Android physical data acquisition
  • Hardware-based techniques
  • JTAG
  • Chip-off
  • Android data recovery techniques

Day 2

iOS forensics

• Apple iOS platform
  • iOS devices and hardware
  • iOS versions, file system and architecture
• iOS security
  • Passcode and Touch ID
  • Privilege separation
  • ASLR and data execution prevention
  • Encryption
• Bypassing iOS security features
  • Operating modes of iOS devices
  • Custom RAMDisk
  • Jailbreaking
  • Bypassing passcode
  • Breaking iOS device encryption keys
  • Establishing trusted communication with desktop computer
• iOS data acquisition and analysis
  • SQLite databases
  • Property lists
  • Other important files (cookies, keyboard cache, recordings, etc.)
• iPhone/iCloud backups
  • Backup structure
  • Extracting and examining unencrypted backups
  • Encrypted backups (extracting and decrypting the keychain)
• iOS data recovery techniques

Windows phones

• Windows Phone OS: partitions and filesystems
• Windows Phone security features
  • Secure boot
  • Application security and data protection
• Windows Phone logical acquisition and analysis
  • Sideloading
  • Extracting SMS, email and application data
• Windows 10 mobile OS forensics

Feature phones forensics

• Acquiring and examining data from feature phones