0%

Explore Courses Defend What Matters

English 日本語
$ USD ¥ JPY
Contact Us
0
Sign In Create Account
Start Learning

Your Bag

Mobile Device Forensics

04 Digital Forensics

Mobile Device Forensics

Extract and interpret evidence from iOS and Android devices, working around encryption, app sandboxes, and cloud sync.

Levels
04
Skill Range
Beginner → Expert
Track
Digital Forensics
Lifetime Access
Enroll Now Explore Courses
Mobile Device Forensics
From 208CREDS

Phones hold the densest record of a person that exists, and they are the hardest devices to examine. This course covers what is actually achievable. You will learn the extraction levels, from logical through file system to physical, and understand what encryption and secure enclaves rule out on modern hardware. iOS analysis covers backups, keychain material, and the SQLite databases behind messages, calls, and location history. Android analysis covers the varied partition layouts, app data directories, and the recovery of deleted SQLite records from write-ahead logs. Cloud and application artefacts are covered because so much now syncs off-device. Legal and consent boundaries are treated seriously throughout, alongside reporting standards.

Curriculum

Learning Path

Each level is enrolled separately. Work through them in order, or start at the level that matches your experience.

  1. Level 01

    Beginner

    208 CREDS

    Purpose

    Understand mobile extraction levels and what encryption rules out.

    Outcome

    You can choose a viable extraction method for a mobile device.

    What You'll Learn
    • Distinguish logical, file system, and physical extraction.
    • Understand what secure enclaves and encryption prevent on modern devices.
    • Choose a realistic approach for a given device and goal.
  2. Level 02

    Intermediate

    451 CREDS

    Purpose

    Analyse iOS evidence from backups, keychain, and app databases.

    Outcome

    You can extract and interpret evidence from an iOS device.

    What You'll Learn
    • Examine iOS backups and keychain material.
    • Query the SQLite databases behind messages, calls, and location.
    • Correlate app data into a coherent account of activity.
  3. Level 03

    Advanced

    664 CREDS

    Purpose

    Analyse Android evidence across varied layouts and recover deleted records.

    Outcome

    You can extract and interpret evidence from an Android device.

    What You'll Learn
    • Navigate varied partition layouts and app data directories.
    • Recover deleted SQLite records from write-ahead logs.
    • Reconcile Android evidence with the account of events.
  4. Level 04

    Expert

    1,037 CREDS

    Purpose

    Handle cloud sync and the legal boundaries that mobile evidence demands.

    Outcome

    You can handle mobile evidence lawfully and report it to standard.

    What You'll Learn
    • Recover cloud and application artefacts that sync off the device.
    • Work within consent and legal boundaries throughout.
    • Report mobile findings to the standard the evidence must meet.