You have to understand how to use them correctly to guide your investigation, instead of just letting the tool report what it believes happened on the device. Your team cannot afford to rely solely on the tools in your lab. Smartphone forensics is more than pressing the "find evidence" button and getting answers. It's easy to get mixed up in what the forensic tools are reporting. FOR585: Smartphone Forensic Analysis In-Depth will teach you those skills.Įvery time the smartphone "thinks" or makes a suggestion, the data are saved. Understanding how to leverage the data from the device in a correct manner can make or break your case and your future as an expert. Mobile devices are often a key factor in criminal cases, intrusions, IP theft, security threats, accident reconstruction, and more. This in-depth smartphone forensic course provides examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices. Are you ready to prove the user was at that location? Do you know how to take this further to place the subject at the location of interest on that specific date and at that time? Tread carefully, because the user may not have done what the tools are showing! The tools show location information tying the device to the place of interest. You rely on your forensic tools to dump and parse the data. How to create, validate, and verify the tools against real datasetsĭON'T MAKE THE MISTAKE OF REPORTING SYSTEM EVIDENCE, SUGGESTIONS, OR APPLICATION ASSOCIATIONS AS USER ACTIVITY.Ī smartphone lands on your desk and you are tasked with determining if the user was at a specific location on a specific date and at a specific time.
How to properly examine databases containing application and mobile artifacts.How to handle locked or encrypted devices, applications, and containers.Advanced acquisition terminology and techniques to gain access to data on smartphones.How to detect, decompile, and analyze mobile malware and spyware.