CC 350 - Mobile Device Forensic Analysis (July 2018)

This course provides the fundamental knowledge and skills necessary to preserve, acquire, and analyze data on iOS devices (iPod Touch, iPhone, and iPad), as well as various Android devices. Students use forensically sound tools and techniques to acquire and analyze potential evidence. Topics include identifying potential threats to data stored on devices, available imaging options, accessing locked devices, and the default folder structure. The forensic artifacts covered include device information, call history, voicemail, messages, web browser history, contacts, and photos.

Course structure:

• Mobile device repair. Learn troubleshooting, teardown, and repair procedures for commonly encountered issues, such as dead batteries, broken screens, and water damage.
• Device handling. Understand how to properly preserve data for imaging and analysis, as well as identify potential threats to data and other locations for potential evidence.
• Device imaging. Learn about imaging options (physical, logical, device backups), bypassing passcodes, and encrypted backups.
• Processing basics. Explore mounting images, partitioning scheme and default folder structure, and types of artifacts (plists, sqlite databases, etc.).
• Application artifacts. Analyze and interpret device information, call history, voicemail, messages, web browser history, contacts, photos, and more.