Mobile Forensics for Kiosk Operators

Online on-demand

Background

Mobile forensic kiosks are widely deployed within law enforcement organisations. They can assist with reducing submissions to specialist digital forensic units, thereby cutting wait times for mobile forensic extractions to be performed and reducing submission backlogs. Kiosks provide pre-configured, easy to follow workflows to guide less experienced personnel through the steps involved in extracting data from mobile devices.

Kiosks deployments have the potential to deliver valuable time and cost savings but bring with them associated risks. They rely on complex volatile digital evidence being handled by staff with relatively little experience and formal training. Training abstractions and commitments for large numbers of staff and frontline deployments can be challenging. This often means that training programmes for kiosk operators tend to focus their limited time on the operation of the equipment and less on understanding the devices, extraction processes and resulting data. Inadequate training could lead to a kiosk operator allowing data to be remotely wiped from an exhibit, failing to extract vital data or missing an opportunity to escalate a complex device to specialist digital forensic colleagues.

Course aims

Mobile Forensics for Kiosk Operators is an on-demand (self-paced) online training course designed to help delegates understand where different data are stored and the extraction processes used in their recovery. Our on-demand delivery allows for flexibility both in where and when delegates complete the course, with learner progress being saved between sessions.

Delegates will learn how to ensure data is preserved in accordance with the ACPO Principles of Computer Based Evidence

Mobile Forensics for Kiosk Operators is “kiosk neutral” in that it is not specific to any particular kiosk supplier. The course content is suitable for law enforcement organisations in the UK and around the world. An optional additional lesson can be tailored (by Control-F) to introduce delegates to organisation-specific policies and procedures.

What you will learn

By the end of the course, delegates will be able to:

  • Isolate a mobile device to prevent it from being remotely wiped or receiving incoming data
  • Explain the differences between logical and physical extractions and identify situations when a physical extraction may be appropriate
  • Distinguish types of data that might reside on a mobile phone handset versus its SIM card or memory card
  • Provide guidance to colleagues on how to corroborate and enrich extracted data by means of Communications Service Provider requests

Who should attend

This entry-level course is targeted at new or existing operators of mobile forensic kiosks. Mobile Forensics for Kiosk Operators is not a replacement for “product training” supplied by the kiosk vendor – rather it is designed to complement such training and could be taken either before or after product training has been completed.

Technical requirements

This online course can be accessed from a desktop or laptop PC with an appropriate Internet connection.

Evaluation

Law enforcement organisations can apply for a test account which can be used to evaluate the course content.