In OpenText EnCase Mobile Device Examinations training course, you will learn to analyze smartphones and mobile devices for evidence for criminal and corporate investigations. This course will provide instruction related to the acquisition of mobile devices using EnCase Forensic followed by the examination via the use of EnCase Mobile Investigator (as well as EnCase Forensic). The course will detail performing acquisitions from both a handset and a device backup followed by examination of devices running the mobile operating systems Android and Apple iOS.
By attending OpenText EnCase Mobile Device Examinations workshop, delegates will learn:
- The history of Android and Apple iOS mobile operating systems
- How to prepare for and conduct an acquisition of an Android device
- How to conduct an acquisition of an Android Samsung S5/S6 device via the android bootloader
- How to conduct an acquisition of an Apple iOS device
- How to conduct an acquisition of Apple iOS backup (including an encrypted backup)
- How to examine the Android system, user, application, and Internet artifacts
- How to examine the Apple iOS system, user, application, and Internet artifacts
- How to conduct an examination of still and moving image file formats
- Understanding the structure of file types and data structures, including (but not limited) to support mobile device applications and system artifacts:
- SQLite databases
- Apple property lists (pLists)
- EXIF
- Knowledge of basic computer forensics will be helpful
The OpenText EnCase Mobile Device Examinations class is ideal for:
- Digital Forensic Investigators, including Law Enforcement, Government, Military, Corporate, IT Security & Litigation Support Professionals.