Day 1: Prep and Imaging

Morning:

• Handsets Overview
• What are IMEI/ IMSI/ MEID’s?
• iOS Apple vs Android user responsive locations
• Preserving the device/ Get device off the network
• Airplane mode/ Faraday bags/ foil/ what phones can be turner off Prepping devices when possible: USB debugging, trusting computers Passcode cracking: Burner Breaker and svStrike

Afternoon:

• Various types of imaging: Physical vs. File System vs Logical vs ADB Rooting: ODIN (Samsung and Kingo- Other Androids)
• iOS imaging details: iTunes backup and lockdown P-List

Day 2: Imaging and Analysis

Morning:

• Continue with imaging
• Creating cases in Secure View: Single device cases and multiple device cases
• Different capabilities of SV Probe: Timeline, Link Graph, Prime List/ Etc.
• Look at data usage to identify ownership, etc. (Example: look at the top 5 people to prove ownership)
• Multiple device cases: Common contacts, conversations and more!

Afternoon:

• App analysis: SQL, DB Forensics, P-list, XML, Time formats in files (Unix vs Mac) Bookmarking data
• Creating reports: Complete vs Evidence

Hands-on practical: Image a device, create a case, locate the evidence, create a report Knowledgebase exam: Online test concerning both forensics and Secure View