Our highly technical, hands-on two-day boot camp is designed to provide you with in-depth coverage of critical techniques and information about identifying, preserving, extracting, analyzing and reporting forensic evidence on mobile devices through use of the most popular mobile forensic tools. You will learn about the challenges of mobile forensics, walk through the process of analysis and examination of mobile devices, and gain deep understanding of differences in evidence locations and examination techniques in Android, iOS and Windows phones. Extracting cloud data and examining feature phones is also covered.

Our course prepares you for the IACRB Certified Mobile Forensics Examiner (CMFE) certification exam and provides practical, hands-on labs that help you to hit the ground running the day your boot camp ends.

• Two days of training with an expert forensics instructor
• Infosec proprietary digital courseware (physical textbooks available to purchase)
• CMFE exam voucher
• 90-day access to cyber range (Flex Pro)
• 90-day access to course replays (Flex Pro)
• Curated videos from other top-rated instructors (add-on)
• 100% Satisfaction Guarantee
• Exam Pass Guarantee (Flex Pro)

Our scenario-based, hands-on labs simulate a real cybercrime investigation. You’ll gain practical skills in locating and examining evidence on devices and forensic images, as well as analyzing and reporting findings. You’ll work with with various commercial and open-source forensic tools within our unique cloud-based learning environment.

• Law enforcement professionals looking to expand into mobile crime investigations
• Legal professionals
• IT and information security professionals being tasked with mobile forensics and incident handling
• Anyone with a desire to learn about mobile forensics and develop their skills

Students must have no criminal record. Basic computer skills, including the ability or desire to work outside the Windows GUI interface, are necessary. A+ certification and/or similar training and experience is not required, but recommended.

This is a very in-depth training course and is not intended for individuals who have limited or no computer skills.

Upon completing our Mobile Forensics Boot Camp, you will know how to:

• Apply the fundamental mobile forensics concepts to forensic investigations
• Identify key technologies used in mobile devices
• Acquire forensic evidence from mobile devices
• Locate forensic artifacts in various mobile operating systems
• Analyze extracted evidence and properly report findings

We don’t just have great instructors, our instructors have years of industry experience and are recognized as experts. Our industry-leading curriculum and expert instructors have led to the highest pass rates in the industry. More than 93% of Infosec students pass their certification exams on their first attempt.

Mobile forensics introduction

• Types of devices
• GPS
• Cell phones
• Tablets
• Vendor and carrier identification
• Obtaining information from cellular provider
• GSM vs. CDMA
• Common tools and methodology

Mobile forensics process

• Mobile forensics challenges
  • OS variety
  • Differences in hardware and filesystems
  • Security features
  • Data volatility
  • Cloud storage
• Types of evidence found on mobile devices
• Collecting mobile devices at the scene
  • Locating devices
  • Preserving volatile data
  • Physical components and accessories (SIM cards, SD cards, chargers, etc.)
  • Older phones and devices
• Comparison of mobile operating systems
  • Android
  • iOS
  • Windows phone
  • Blackberry OS
• Data acquisition methods
  • Logical acquisition
  • Physical acquisition
  • Manual acquisition
• Reporting findings

Android forensics

• Android platform
  • Hardware
  • SDK and debug bridge
  • File systems and data structures
• Android security model
  • Secure kernel and permissions
  • Full disk encryption
  • App security
• Bypassing Android security features
  • Bootloader/recovery mode
  • Rooting an Android device
  • Lock screen bypassing techniques
• Android logical data acquisition and analysis
  • Extracting the /data directory
  • Device information
  • SMS/MMS, email, browsing and social networking data
  • App and cloud data
• Android physical data acquisition
  • Hardware-based techniques
  • JTAG
  • Chip-off
  • Android data recovery techniques

iOS forensics

• Apple iOS platform
  • iOS devices and hardware
  • iOS versions, file system and architecture
• iOS security
  • Passcode and Touch ID
  • Privilege separation
  • ASLR and data execution prevention
  • Encryption
• Bypassing iOS security features
  • Operating modes of iOS devices
  • Custom RAMDisk
  • Jailbreaking
  • Bypassing passcode
  • Breaking iOS device encryption keys
  • Establishing trusted communication with desktop computer
• iOS data acquisition and analysis
  • SQLite databases
  • Property lists
  • Other important files (cookies, keyboard cache, recordings, etc.)
• iPhone/iCloud backups
  • Backup structure
  • Extracting and examining unencrypted backups
  • Encrypted backups (extracting and decrypting the keychain)
• iOS data recovery techniques

Windows phones

• Windows Phone OS: partitions and filesystems
• Windows Phone security features
  • Secure boot
  • Application security and data protection
• Windows Phone logical acquisition and analysis
  • Sideloading
  • Extracting SMS, email and application data
• Windows 10 mobile OS forensics

Feature phones forensics

• Acquiring and examining data from feature phones