Mobile Computer Forensics Fundamentals

Comparison of older mobile devices to modern day smartphone in regard to kinds of data that is available.

Discussion of predominant mobile operating systems and the difference of each one.   

Characteristics of a crime scene specifically in regard to mobile devices and the handling of them.  As well as issue specific to securing mobile devices 

Mean and purpose of the isolating mobile devices from different kinds of signals and frequencies.  Discussion of different traps that could be on the device that could impede securing of the device.

Consideration when packing and transporting the device from the scene.  What consideration are needed when storing the device for later analysis?

Pros and cons of on site triage of device.  What is the minimal training that any first responder should have when dealing with mobile device?

Types of evidence found on a mobile device.  Where can mobile evidence be found.

How to identify the device you are dealing with by characteristics, interface, labels and carrier. 

What is a SIM card?  How do you remove a SIM card from a device?  How do you read the SIM card and what data can be obtained from a SIM card?

How to chose a tool.  What are the criteria for picking a tool?  Testing the tool so that you can understand what it is doing.

Pros and cons of open source verse commercial tools.  Operating system considerations when picking a tool.  Different mobile forensics tools based on OS.

Considerations for the acquisition process, acquisition itself and date/time.  Proper procedure when dealing with various device states. 

Difference between physical and logical extraction.  Which is preferred and why? 

Demonstration of the logical acquisition of an Android phone and what evidence is acquired.

Demonstration of acquisition of the iPhone backup.

Demonstration of tools used to examine the iPhone extraction and what evidence can be found.

Best practices for incorporating mobile devices into forensics reports.