DF330 Advanced Digital Forensic Analysis: iOS & Android (Mar 2019)

This course provides the fundamental knowledge and skills necessary to preserve, acquire, and analyze data on iOS devices (iPod Touch, iPhone, and iPad), as well as various Android devices. Students use forensically sound tools and techniques to acquire and analyze potential evidence. Topics include identifying potential threats to data stored on devices, using available imaging options, accessing locked devices, and understanding the default folder structure. The forensic artifacts covered include device information, call history, voicemail, messages, web browser history, contacts, and photos.

Course structure:

• Mobile device repair. Understand troubleshooting, teardown, and repair procedures for issues such as dead batteries, broken screens, and water damage.
• Device handling. Learn about properly preserving data for imaging and analysis, as well as identifying potential threats to data and finding other locations for potential evidence.
• Device imaging. Learn about imaging options (physical, logical, device backups), bypassing passcodes, and encrypted backups.
• Processing basics. Understand mounting images, partitioning scheme and default folder structure, and types of artifacts (plists, sqlite databases, etc.).
• Application artifacts. Learn about analyzing and interpreting device information, call history, voicemail, messages, web browser history, contacts, photos, and more.