Course 12–3 days · 16–24 hours
Practical Mobile Artifact Validation: Beyond Push-Button Forensics
For: Digital forensic examiners, investigators who extract devices, intelligence analysts
Moves examiners from accepting what the tool reports to proving it. Built around the seven phases of the mobile forensic process, with hands-on iOS and Android practicals.
View curriculum
- Module 1: The Seven-Phase Process. Identification, documentation, collection and preservation, acquisition, analysis, reporting, and testimony, and where errors enter at each phase.
- Module 2: Acquisition Levels & Encryption States. Manual, logical, file system, full file system, and physical extractions; AFU vs. BFU; and the 72-hour inactivity reboot.
- Module 3: Device & Network Identifiers. IMEI, IMSI, ICCID, and MSISDN, and what each one ties to.
- Module 4: Artifacts That Matter. Key iOS and Android artifacts, time-sensitive data that ages out on its own, and SD cards.
- Module 5: The Truth in SQLite. Querying databases, write-ahead logs, checkpoints, and where deleted records really come from.
- Module 6: Timestamps. Unix epoch, Mac Absolute Time, UTC, and time zone shifts across artifacts.
- Module 7: Tool Report vs. Examiner Report. Validating findings with open-source parsers such as iLEAPP and ALEAPP, test data, and peer review.
- Module 8: Hands-On Practicals. iOS and Android analysis, comparing tools against each other, and documenting what you verified.
Course 21 day · 8 hours
Digital Evidence for Investigators & Prosecutors
For: Investigators, patrol supervisors, prosecutors, solicitors, crime analysts
What every investigator and prosecutor should know about digital evidence, from the moment a device is found to the day it is presented in court.
View curriculum
- Module 1: Why Mobile Evidence Matters. Locard's Exchange Principle applied to devices, and the challenges of modern mobile investigations.
- Module 2: Identification & Documentation. Devices that hold evidence, including phones, tablets, SIM and SD cards, DVRs, and vehicles, plus chain of custody.
- Module 3: Seizure & Preservation. Network isolation, leaving the power state alone, not browsing the phone, documenting every action, and beating the 72-hour clock.
- Module 4: Legal Authority. Search warrants, consent and who can give it, decedent devices, seizure vs. examination authority, and relevant case law.
- Module 5: Working With the Lab. Writing a specific exam request, reading a reader report, tagging evidence, and having key findings verified.
- Module 6: Vehicle Data. What infotainment and telematics systems record, and how to collect a vehicle correctly.
Course 31 day · 8 hours
Surviving the Stand: Defending Digital Forensics in Court
For: Sworn examiners, private consultants, expert witnesses
An advanced workshop on qualifying as an expert, testifying clearly, and defending your methodology under cross-examination.
View curriculum
- Module 1: Pre-Trial Preparation & Documentation. Chain of custody, tool validation records, standard operating procedures, and your CV.
- Module 2: Tool Report vs. Examiner Report. What belongs in your report, what does not, and how to explain the difference on the stand.
- Module 3: Breaking the Jargon Barrier. Explaining encryption states, databases, timestamps, and hashes with analogies a jury understands.
- Module 4: Anticipating Defense Challenges. Contamination claims, tool reliability, software version differences, and data you could not recover.
- Module 5: Mock Cross-Examination. Live, scenario-based cross-examination with direct, actionable feedback.
Course 41 day · 8 hours
The Crime Analyst’s Role in Using Technology in Homicide Investigations
For: Crime analysts, homicide investigators, investigative supervisors
How crime analysts use cellular records, databases, social media, and other technology to identify suspects and build the timeline in a homicide investigation.
View curriculum
- Module 1: The Analyst’s Role. The crime analyst's role in law enforcement, and specifically in a homicide investigation.
- Module 2: Cellular Records Analysis. Call detail records, historical cell site location information, Carpenter v. United States, carrier retention, what to ask the analyst for, and what an analyst can testify to.
- Module 3: Database Research & OSINT. Law enforcement databases, how to get access, and open-source intelligence.
- Module 4: Social Media Research. Finding links between people and accounts, unique account identifiers, and preserving and obtaining social media data.
- Module 5: License Plate Readers. What ALPR systems capture besides plates, and how analysts use that data.
- Module 6: Facial Recognition. What it is, what it is not, and why results must be corroborated by other evidence.
- Module 7: Electronic Offender Monitoring. What monitoring data shows and how it can be used in an investigation.
- Module 8: Mapping & Presentation. Geographic mapping, static vs. animated maps, and timeline presentations.
