ForensicSpot10 modules
Mobile and Network Forensics
Forensics of phones and networks: mobile acquisition, app and location data, SIM and cloud, packet capture, log analysis, IoT, and courtroom reporting.
- 60hours
- 30topics
- 10modules
Module 16 hrs3 topics
Mobile and Network Forensics Foundations
The scope of mobile and network forensics and where they fit.
Start module- Mobile and Network Forensics: Scope and DisciplineDefines what mobile and network forensics investigates, how the two disciplines complement each other, and their shared evidence types and legal frameworks.13 min
- Digital Evidence in Mobile and Network ContextsExamines volatile and persistent evidence on mobile devices and networks, and chain-of-custody requirements from seizure through analysis.13 min
- Legal and Jurisdictional Frameworks for Mobile and Network EvidenceSurveys the international legal landscape for interception, data seizure, and cross-border requests, comparing statutes and MLAT mechanisms.13 min
Module 26 hrs3 topics
Mobile Device Architecture and Data
How phones store data: file systems, memory, and where evidence lives.
Start module- Mobile Device Hardware ArchitectureDescribes smartphone hardware including SoC design, NAND/eMMC/UFS memory, and baseband processors, and how design affects data recovery.13 min
- Mobile Operating Systems and File SystemsCompares iOS and Android architectures, sandboxing models, and file systems such as APFS, ext4, and F2FS, plus their directory structures.13 min
- Data Persistence and Evidence Locations on Mobile DevicesMaps where evidence lives on mobile devices, including SQLite databases and keychain entries, and how flash wear-leveling affects deleted-data recovery.13 min
Module 36 hrs3 topics
Mobile Acquisition Methods
Logical, file-system and physical acquisition, JTAG and chip-off.
Start module- Logical and File-System AcquisitionCovers logical acquisition via vendor APIs and file-system extraction, comparing the scope, limitations, and tools of each method.13 min
- Physical Acquisition TechniquesExplains full-disk physical acquisition including EDL mode and bootloader exploits, and how encryption affects feasibility.13 min
- JTAG and Chip-Off AcquisitionDescribes JTAG and chip-off hardware extraction methods, the specialist equipment required, and the damage risks each carries.13 min
Module 46 hrs3 topics
Analysing Mobile Artifacts
Messages, app data, call logs, location history and deleted-data recovery.
Start module- Call Logs, SMS, and Messaging App ArtifactsDetails how call records, SMS/MMS, and messaging apps like WhatsApp, Signal, and iMessage store data, and how to parse those databases.13 min
- Location History and Geolocation ArtifactsExamines location evidence from GPS logs, Wi-Fi probe histories, cell-tower records, and app caches, and how to correlate them.13 min
- Deleted Data Recovery on Mobile DevicesSurveys recovering deleted records from SQLite free pages and unallocated NAND blocks, and how OS version and encryption affect success.13 min
Module 56 hrs3 topics
SIM, Cloud and Backup Forensics
SIM data, cloud accounts, and device backups as evidence sources.
Start module- SIM Card ForensicsExplains SIM/USIM data including IMSI, contacts, SMS records, and location update history, and what it proves in a network context.13 min
- Cloud Account ForensicsDescribes obtaining cloud-service data from Apple, Google, and Microsoft under lawful process, and legal differences across jurisdictions.13 min
- Device Backup ForensicsDetails iOS iTunes/iCloud and Android backup structures and extracting forensic value without device access, including manifest databases.13 min
Module 66 hrs3 topics
Network Forensics Foundations
The OSI model, protocols and network evidence sources for investigators.
Start module- The OSI Model and Protocols for Network InvestigatorsGives investigators a working OSI model, focused on TCP/IP, DNS, and HTTP/S as the protocols that generate forensic artefacts.13 min
- Network Evidence Sources and Their Forensic ValueSurveys network evidence sources including router logs, DHCP leases, NetFlow records, and intrusion detection alerts, and their reliability.13 min
- Reconstructing a Network Timeline from Multiple SourcesExplains correlating timestamps, IPs, and session identifiers across log sources into a coherent timeline, including clock-skew normalisation.13 min
Module 76 hrs3 topics
Packet Capture and Traffic Analysis
Capturing and interpreting network traffic to reconstruct events.
Start module- Packet Capture Tools and MethodsCovers capture tools including Wireshark, tcpdump, and network taps, and capture placement strategy for complete, intact packet collections.13 min
- Traffic Analysis and Protocol DissectionDescribes reconstructing sessions and detecting anomalies from packet captures, using display filters, stream reassembly, and file carving.13 min
- Encrypted Traffic AnalysisExplains what investigators learn from TLS sessions without decryption, including SNI, certificate metadata, and traffic-timing analysis.13 min
Module 86 hrs3 topics
Log Analysis and Network Artifacts
Server, firewall and application logs, and correlating them.
Start module- Server and Application Log AnalysisDetails extracting investigative value from web, email, database, and application logs, and detecting anti-forensic log-clearing.13 min
- Firewall and Intrusion Detection Log AnalysisExplains interpreting firewall logs, IDS/IPS alerts, and proxy records to reconstruct attacker activity and exfiltration paths.13 min
- Log Correlation and SIEM in Forensic InvestigationsDescribes how SIEM platforms aggregate and correlate logs for incident response, and the limitations of log retention policies as evidence.13 min
Module 96 hrs3 topics
Wireless, IoT and Emerging Devices
Wi-Fi, Bluetooth, wearables and IoT as evidence.
Start module- Wi-Fi ForensicsCovers Wi-Fi artefacts including access-point association logs, probe request histories, and 802.11 packet evidence placing a device.13 min
- Bluetooth ForensicsExamines Bluetooth and BLE evidence including pairing records and data over RFCOMM and GATT profiles, and acquisition methods.13 min
- IoT and Wearable Device ForensicsSurveys smart-home, wearable, and embedded IoT devices as evidence sources, including sensor logs and smart-speaker recordings.13 min
Module 106 hrs3 topics
Tools, Reporting and Legal Issues
Common toolchains, validation, reporting and admissibility.
Start module- Mobile and Network Forensics ToolchainsSurveys mobile tools like Cellebrite UFED and Oxygen Detective, and network tools like Wireshark and Zeek, on capability and licensing.13 min
- Tool Validation and Scientific ReliabilityExplains why forensic tools need validation before casework, covering NIST CFTT and Daubert/Frye standards for admissibility.13 min
- Forensic Reporting and Expert Testimony in Mobile and Network CasesDescribes the structure of a mobile and network forensic report and how examiners present conclusions and withstand cross-examination.13 min