About the course
FOR585 is continuously updated to keep up with the latest malware, smartphone operating systems, third-party applications, acquisition shortfalls, extraction techniques (jailbreaks and roots) and encryption. It offers the most unique and current instruction to arm you with mobile device forensic knowledge you can immediately apply to cases you're working on the day you get back to work.
What You Will Learn
FOR585: Smartphone Forensic Analysis In-Depth will help you understand:
- Where key evidence is located on a smartphone
- How the data got onto the smartphone
- How to recover deleted mobile device data that forensic tools miss
- How to decode evidence stored in third-party applications
- How to detect, decompile, and analyze mobile malware and spyware
- Advanced acquisition terminology and techniques to gain access to data on smartphones
- How to handle locked or encrypted devices, applications, and containers
- How to properly examine databases containing application and mobile artifacts
- How to create, validate, and verify the tools against real datasets
SMARTPHONES HAVE MINDS OF THEIR OWN.
This in-depth smartphone forensic course provides examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices. Mobile devices are often a key factor in criminal cases, intrusions, IP theft, security threats, accident reconstruction, and more. Understanding how to leverage the data from the device in a correct manner can make or break your case and your future as an expert. FOR585: Smartphone Forensic Analysis In-Depth will teach you those skills.
Every time the smartphone "thinks" or makes a suggestion, the data are saved. It's easy to get mixed up in what the forensic tools are reporting. Smartphone forensics is more than pressing the "find evidence" button and getting answers. Your team cannot afford to rely solely on the tools in your lab. You have to understand how to use them correctly to guide your investigation, instead of just letting the tool report what it believes happened on the device. It is impossible for commercial tools to parse everything from smartphones and understand how the data were put on the device. Examination and interpretation of the data is your job and this course will provide you and your organization with the capability to find and extract the correct evidence from smartphones with confidence.
FOR585 features 31 hands-on labs, a forensic challenge, and a bonus take-home case that allow students to analyze different datasets from smart devices and leverage the best forensic tools, methods, and custom scripts to learn how smartphone data hide and can be easily misinterpreted by forensic tools. Each lab is designed to teach you a lesson that can be applied to other smartphones. You will gain experience with the different data formats on multiple platforms and learn how the data are stored and encoded on each type of smart device. The labs will open your eyes to what you are missing by relying 100% on your forensic tools.
This intensive six-day course is continuously updated to keep up with the latest malware, smartphone operating systems, third-party applications, acquisition shortfalls, extraction techniques (jailbreaks and roots), malware, and encryption. FOR585 offers the most unique and current instruction on the planet, and it will arm you with mobile device forensic knowledge you can immediately apply to cases you're working on the day you get back to work.
You Will Be Able To
- Select the most effective forensic tools, techniques, and procedures to effectively analyze smartphone data
- Reconstruct events surrounding a crime using information from smartphones, including timeline development and link analysis (e.g., who communicated with whom, where, and when)
- Understand how smartphone file systems store data, how they differ, and how the evidence will be stored on each device
- Interpret file systems on smartphones and locate information that is not generally accessible to users
- Identify how the evidence got onto the mobile device - we'll teach you how to know if the user created the data, which will help you avoid the critical mistake of reporting false evidence obtained from tools
- Incorporate manual decoding techniques to recover deleted data stored on smartphones and mobile devices
- Tie a user to a smartphone on a specific date/time and at various locations
- Recover hidden or obfuscated communication from applications on smartphones
- Decrypt or decode application data that are not parsed by your forensic tools
- Detect smartphones compromised by malware and spyware using forensic methods
- Decompile and analyze mobile malware using open-source tools
- Handle encryption on smartphones and bypass, crack, and/or decode lock codes manually recovered from smartphones, including cracking iOS backup files that were encrypted with iTunes
- Understand how data are stored on smartphone components (SD cards) and how encrypted data can be examined by leveraging the smartphone
- Extract and use information from smartphones and their components, including Android, iOS, BlackBerry 10, Windows Phone, Chinese knock-offs, and SD cards (bonus labs available focusing on BlackBerry, BlackBerry backups, Nokia [Symbian], and SIM card decoding)
- Perform advanced forensic examinations of data structures on smartphones by diving deeper into underlying data structures that many tools do not interpret
- Analyze SQLite databases and raw data dumps from smartphones to recover deleted information
- Perform advanced data-carving techniques on smartphones to validate results and extract missing or deleted data
- Apply the knowledge you acquire during the course to conduct a full-day smartphone capstone event involving multiple devices and modeled after real-world smartphone investigations
FOR585 Course Topics
- Malware and Spyware on Smartphones
- Mobile devices in incident-response cases
- Determining if malware or spyware exist
- Handling the isolation of the malware
- Decompiling malware to conduct in-depth analysis
- Determining what has been compromised
- Forensic Analysis of Smartphones and Their Components
- SD cards
- Cloud-based backups and storage
- Cloud-synced data - Google and more
- Devices that have intentionally been modified - deleting, wiping, and hiding applications
- Deep-Dive Forensic Examination of Smartphone File Systems and Data Structures
- Recovering deleted information from smartphones
- Examining SQLite databases in-depth
- Finding traces of user activities on smartphones
- Recovering data from third-party applications
- Tracing user online activities on smartphones (e.g., messaging and social networking)
- Examining application files of interest
- Manually decoding to recover missing data and verify results
- Developing SQL queries to parse databases of interest
- Understanding the user-based and smartphone-based artifacts
- Leveraging system and application usage logs to place the device in a location and state when applications were use
- In-Depth Usage and Capabilities of the Best Smartphone Forensic Tools
- Using your tools in ways you didn't know were possible
- Leveraging custom scripts to parse deleted data
- Leveraging scripts to conduct forensic analysis
- Carving data
- Developing custom SQL queries
- Conducting physical and logical keyword searches
- Manually creating timeline generation and link analysis using information from smartphones
- Tool validation based on trusted datasets
- Using geolocation information from smartphones and smartphone components to place a suspect at a location when an artifact was created
- Handling Locked and Encrypted Devices
- Extracting evidence from locked smartphones
- Bypassing encryption (kernel and application level)
- Cracking passcodes
- Decrypting backups of smartphones
- Decrypting third-party application files
- Examining encrypted data from SD cards
- Incident Response Considerations for Smartphones
- How your actions can alter the device
- How to handle Hot and Cold devices
- How to prevent remote access on the device
- How to tie a user or activity to a device at a specific time
- How mobile device management can hurt as much as help you
FOR585 features 31 hands-on labs and a final forensic challenge to ensure that students not only learn the material, but can also execute techniques to manually recover data. Some labs allow you to "choose your own adventure" so that students who may need to focus on a specific device can select relevant labs and go back to the others as time permits. The labs cover the following topics:
- Malware and Spyware -- Two labs are designed to teach students how to identify, manually decompile, and analyze malware recovered from an Android device. The processes used here reach beyond commercial forensic kits and methods. Bonus IPA and APK files are provided for practice. Two additional bonus labs are available on the USB.
- Android Analysis -- Four labs are designed to teach students how to manually crack locked devices, carve for deleted data, validate tool results, place the user behind an artifact, and parse third-party application files for user-created data not commonly parsed by commercial forensic tools. Open-source methods are utilized and highlighted where possible. An additional lab teaches students how to manually crack lockcodes from Android devices. A bonus lab encourages students to manually interact with a live device to pull relevant information using free methods.
- iOS Analysis -- Five labs are designed to teach students how to manually carve for deleted data, validate tool results, manually parse plists and databases of interest, and parse third-party application files for user-created data not commonly parsed by commercial forensic tools. In addition, methods for "tricking" your tools into parsing data from encrypted images are built into the labs. A bonus lab encourages students to manually interact with a live device to pull relevant information using free methods. There are other bonus iOS labs on the course USB.
- Backup File Analysis -- Three labs are designed to teach students how to parse data from iOS and Android backup files. These labs will drive students to parse data from databases, plists, and third-party application data. A bonus lab on BlackBerry backups is provided.
- Wiped Phone Analysis -- This is one of the more challenging labs for students, as the device used will have been wiped prior to acquisition. Students will be able to test all of the methods they learned during the course to see what can really be recovered from a wiped smartphone.
- BlackBerry 10 Analysis -- This all-encompassing lab provides students with a chance to tie external media (SIM cards) to a device, understand how data are manually carved and parsed, and understand how BlackBerry 10 applications differ from Android and iOS. Will you be able to identify a BlackBerry running Android applications? The methods used in this lab will apply to other smartphones that contain SIM cards and leverage third-party applications (Android, Windows Phone, Nokia, etc.)
- Knock-off Phone Analysis -- This lab focuses on handling knock-off devices, understanding the file system, and decoding the data not parsed by commercial tools.
- Third-Party Application Analysis -- These labs challenge students to examine third-party applications pulled from multiple smartphone devices, and to manually parse applications that are not commonly parsed by commercial tools.
- Parsing Application Databases -- These three labs provide students the opportunity to write SQL queries to parse tables of interest and to recover attachments associated with chats, deleted chats, and data from secure chat applications. The labs will challenge students to dig deep beyond what a commercial tool can offer.
- Browser Analysis -- This lab is focused on showing similarities and differences between computer and mobile browser artifacts. Your commercial tools may be good at parsing some evidence, but this lab will highlight what is missed!