Tag Archive for: Online on-demand

Understanding Mobile Forensic Data

1½ days • Online on-demand

Background

Data recovered from mobile devices plays a vital role in an increasing number of investigations. Our mobile devices contain an imprint of how we live our lives: who we know, where we go, what we think and what we do. Being able to explore and analyse the data behind that imprint gives investigators a unique insight into the whereabouts, actions and opinions of both victims and defendants.

Yet mobile forensics is far from simple. The types and volume of data which can be recovered depend upon a host of factors. Not only that, the data which can be recovered has origins in multiple sources – some reliable, some less so. Mobile forensic data can seem bewildering or overwhelming, meaning that there is a real risk that valuable data may be overlooked.

Course aims

Understanding Mobile Forensic Data is an on-demand (self-paced) online course designed to teach delegates how data is recovered from mobile devices, the origins and reliability of such data and its relevance within an investigation.

Delegates will learn about the differences between logical, physical and full filesystem extractions as well as why some of those techniques may not be available in some situations. Through the use of engaging and interactive visual content, delegates will learn where location data and time and date information present in mobile devices originate from. Crucially, the course will highlight data which once recovered from a mobile device should be corroborated or enriched with data from other sources (for example, a Communications Service Provider).

What you will learn

By the end of the course, delegates will be able to:

  • Explain what a digital forensic artefact is and provide three examples
  • Explain how logical and ‘full filesystem’ extractions of the same device might differ
  • Give two examples of mobile forensic data which require corroboration via a Communications Service Provider
  • Evaluate competing strategies for progressing an investigation using digital forensic data

Who should attend?

This entry-level course is targeted at anyone who needs to understand the origins, scope and relevance of data recovered from mobile devices. This will include frontline police officers, investigators, analysts, case officers, senior police officers, lawyers, judges and more. 

Successful completion of this course is a pre-requisite for attendance of our classroom training course ‘Reviewing Mobile Forensic Data’.

Course access and duration

This online course can be accessed from a desktop or laptop PC with an appropriate internet connection and comprises approximately 1½ days content. Our on-demand delivery allows for flexibility both in where and when delegates complete the course, with learner progress being saved between sessions.

Mobile Forensics for Kiosk Operators

Online on-demand

Background

Mobile forensic kiosks are widely deployed within law enforcement organisations. They can assist with reducing submissions to specialist digital forensic units, thereby cutting wait times for mobile forensic extractions to be performed and reducing submission backlogs. Kiosks provide pre-configured, easy to follow workflows to guide less experienced personnel through the steps involved in extracting data from mobile devices.

Kiosks deployments have the potential to deliver valuable time and cost savings but bring with them associated risks. They rely on complex volatile digital evidence being handled by staff with relatively little experience and formal training. Training abstractions and commitments for large numbers of staff and frontline deployments can be challenging. This often means that training programmes for kiosk operators tend to focus their limited time on the operation of the equipment and less on understanding the devices, extraction processes and resulting data. Inadequate training could lead to a kiosk operator allowing data to be remotely wiped from an exhibit, failing to extract vital data or missing an opportunity to escalate a complex device to specialist digital forensic colleagues.

Course aims

Mobile Forensics for Kiosk Operators is an on-demand (self-paced) online training course designed to help delegates understand where different data are stored and the extraction processes used in their recovery. Our on-demand delivery allows for flexibility both in where and when delegates complete the course, with learner progress being saved between sessions.

Delegates will learn how to ensure data is preserved in accordance with the ACPO Principles of Computer-Based Evidence

Mobile Forensics for Kiosk Operators is “kiosk neutral” in that it is not specific to any particular kiosk supplier. The course content is suitable for law enforcement organisations in the UK and around the world. An optional additional lesson can be tailored (by Control-F) to introduce delegates to organisation-specific policies and procedures.

What you will learn

By the end of the course, delegates will be able to:

  • Isolate a mobile device to prevent it from being remotely wiped or receiving incoming data
  • Explain the differences between logical and physical extractions and identify situations when a physical extraction may be appropriate
  • Distinguish types of data that might reside on a mobile phone handset versus its SIM card or memory card
  • Provide guidance to colleagues on how to corroborate and enrich extracted data by means of Communications Service Provider requests

Who should attend

This entry-level course is targeted at new or existing operators of mobile forensic kiosks. Mobile Forensics for Kiosk Operators is not a replacement for “product training” supplied by the kiosk vendor – rather it is designed to complement such training and could be taken either before or after product training has been completed.

Technical requirements

This online course can be accessed from a desktop or laptop PC with an appropriate Internet connection.

Evaluation

Law enforcement organisations can apply for a test account which can be used to evaluate the course content.